cdk-preflight 0.0.47 → 0.0.49

package/.jsii

@@ -9415,7 +9415,7 @@
   },
   "name": "cdk-preflight",
   "readme": {
-    "markdown": "# cdk-preflight\n\n[![monthly real-deploy verification](https://github.com/badmintoncryer/cdk-preflight/actions/workflows/monthly-verify.yml/badge.svg)](https://github.com/badmintoncryer/cdk-preflight/actions/workflows/monthly-verify.yml)\n\n**Catch deploy-time CloudFormation failures at `cdk synth` time.**\n\nSome CloudFormation constraints are not expressed in resource provider schemas — they live only in documentation, in service API validation, or across multiple properties. Templates that violate them pass `cdk synth`, pass CloudFormation pre-deployment validation, and then fail minutes into a deployment, burning a rollback cycle.\n\ncdk-preflight is a curated [Rego rule pack](docs/rules.md) for exactly those constraints, evaluated with the CloudFormation validation engine that ships inside `aws-cdk-lib` (>= 2.267.0). By default a violation **fails `cdk synth`** — a template that is known to fail at deploy time never leaves your machine.\n\nThe pack aims at **every deploy-time failure that no existing CDK mechanism already catches** — nothing narrower. Every bundled rule is backed by a `fail`/`pass` template pair, and the failure has been reproduced against real AWS (or is explicitly marked `doc-only`). Rules that the built-in validation engine already covers are deliberately **not** duplicated — a test suite enforces this.\n\n> **Requires `aws-cdk-lib` >= 2.267.0** (released 2026-08-27) — the first release that bundles\n> the CloudFormation validation engine. On older versions the rules cannot run at all.\n\n## Quick start\n\n```bash\nnpm i -D cdk-preflight\nnpx cdkpf init   # inserts Preflight.apply(app) into your CDK app\n                         # (`npx cdkpf init` is the same command, shorter)\n```\n\nor add one line yourself:\n\n```ts\nimport { Preflight } from 'cdk-preflight';\n\nconst app = new App();\nPreflight.apply(app);\n```\n\nOn violation, `cdk synth` fails with one error per finding, including the construct trace:\n\n```text\nERROR idle_timeout.timeout_seconds is 5000 but must be between 1 and 4000 seconds (cdk-preflight)\n   MyStack/Alb/Resource (Alb16C2F182) aws-cdk-lib.aws_elasticloadbalancingv2.CfnLoadBalancer\n\nSynthesis finished with errors\n```\n\n## Observe-only mode\n\nTo roll the rules out gradually, start with `enforce: false`: findings then surface as synth **warnings** through the CDK built-in validator, with construct traces and per-finding acknowledgement:\n\n```ts\nPreflight.apply(app, { enforce: false });\n```\n\n```text\nWARNING idle_timeout.timeout_seconds is 5000 but must be between 1 and 4000 seconds (CloudFormation Validate)\n   MyStack/Alb (Alb) aws-cdk-lib.aws_elasticloadbalancingv2.CfnLoadBalancer\n   Acknowledge with 'CloudFormation-Validate::pf-elbv2-lb-idle-timeout-range'\n```\n\n| Option | Default | Effect |\n|---|---|---|\n| `enforce` | `true` | Violations of bundled rules fail synthesis; set to `false` to only warn |\n| `strict` | `false` | With `enforce`: also fail on error-class findings (`ERROR`/`FATAL`, e.g. `F3034`) of the built-in validation engine itself, which the CDK currently downgrades to warnings |\n| `exclude` | `[]` | Rule ids to disable |\n| `includeUpstreamPending` | `true` | Include rules already proposed to the upstream engine but not yet merged |\n\nTo opt out of a single rule, pass its id in `exclude`. In observe-only mode, individual findings can also be suppressed with the CDK acknowledge mechanism shown in the warning text.\n\n## Bundled rules\n\nSee [docs/rules.md](docs/rules.md) for the generated rule table. Highlights:\n\n- **ELBv2**: `idle_timeout` / `deregistration_delay` / `slow_start` attribute ranges (stringly-typed Key/Value attributes are invisible to schema validation)\n- **IAM**: managed (6,144 chars) and inline (role/group/user) policy document size limits\n- **CloudFront**: `MinTTL <= DefaultTTL <= MaxTTL` ordering, ACM certificates must live in `us-east-1`\n- **Step Functions**: `Next`/`Default`/`Choices` must reference defined states (a dangling `StartAt` is already caught by the engine's built-in `E3601`)\n- **EC2**: security group TCP/UDP port ranges and `FromPort <= ToPort`\n\n## For AI agents\n\nTo add cdk-preflight to a CDK app:\n\n1. `npm i -D cdk-preflight`\n2. `npx cdk-preflight init` — or the shorter alias `npx cdkpf init` (finds the entry point via `cdk.json` and inserts `Preflight.apply(app)`; use `--dry-run` to preview)\n3. Run `cdk synth`. Violations fail the synth with a validation report; each finding carries a rule id, the actual value, and a suggested fix\n4. To fix a finding, prefer correcting the resource. To opt out instead: `exclude: ['<rule-id>']` disables one rule, `enforce: false` switches to warn-only reporting\n\nThe machine-readable findings are written to `cdk.out/validation-report.json` when synthesizing with `-c @aws-cdk/core:validationReportJson=true`.\n\n### Report missed deploy errors\n\ncdk-preflight only knows the failure modes it has benched. When a deploy fails on a constraint the pack should have caught, that report is how new rules get added — but at that moment cdk-preflight is out of the loop (it passed the synth), so the instruction has to already sit in your agent's context. Paste this into your repository's `AGENTS.md` (or `CLAUDE.md`):\n\n```markdown\n## cdk-preflight: report missed deploy errors\n\nIf `cdk deploy` fails even though `cdk synth` (with cdk-preflight enabled) passed,\nand the failure is a service-side validation rejection — CREATE_FAILED/UPDATE_FAILED\nwith a 400-class message such as \"Invalid request provided: ...\" — cdk-preflight is\nmissing a rule. Report it:\n\n1. Qualify first. NOT reportable: AccessDenied / permissions, service quotas,\n   throttling, name conflicts with existing resources, stabilization timeouts.\n2. Redact account-specific data (account IDs -> 123456789012, real ARNs/domains\n   -> placeholders).\n3. Search existing issues: https://github.com/badmintoncryer/cdk-preflight/issues\n4. With your user's approval, open a \"Missed deploy error\" issue with the verbatim\n   error message, the resource type, a minimal template snippet, and your\n   aws-cdk-lib / cdk-preflight versions.\n```\n\n## Scope and rule lifecycle\n\nA constraint belongs in the pack when violating it makes a real deployment fail *and* no layer that sees the same synthesized template already blocks it. There is no further \"is this worth a rule\" question — if the gap is real, it gets a rule.\n\nCDK L2 construct validation is deliberately **not** one of those layers. `CfnXxx` usage, escape hatches, `addPropertyOverride`, `cloudformation-include` and migrated templates all bypass L2, so an L2 guard covering the same mistake neither disqualifies a rule nor retires one.\n\nThat makes growth the normal state, and it has a consequence worth knowing before you upgrade: **new rules land in minor releases, so a minor upgrade can newly fail a `cdk synth` that passed yesterday.** That is intended, not a regression. If you need a frozen rule set, pin the version; to drop a single rule, `exclude: ['<rule-id>']`; to see everything without failing the build, `enforce: false`.\n\nRules move the other way too. Once the validation engine bundled in `aws-cdk-lib` (or CloudFormation's own pre-deploy validation) starts blocking a constraint, the rule is deleted rather than kept as a duplicate — staying on an older `aws-cdk-lib` and an older cdk-preflight keeps the old behavior.\n\n## How it works\n\n`Preflight.apply()` evaluates the rules with the [cloudformation-validate](https://github.com/aws-cloudformation/cloudformation-validate) Rust/WASM engine that ships inside `aws-cdk-lib` — no extra binaries, no network access at synth time. In the default enforce mode the engine is invoked through a dedicated CDK validation plugin so that violations fail synthesis; with `enforce: false` the rules are instead injected into the CDK built-in `CloudFormationValidatePlugin` and reported as warnings.\n\nConstraints that *can* be expressed in schemas or generic engine rules also make good upstream PRs to that engine, but nothing here waits on one — the upstream release cycle is deliberately slower than this pack's. Each rule's `meta.yaml` tracks its upstream status so that retirement stays bookkeeping.\n\n## Requirements\n\n- `aws-cdk-lib` >= 2.267.0, released 2026-08-27 (the first release that bundles the built-in CloudFormation validator). This is a recent release — an existing CDK app may need an upgrade before cdk-preflight can run.\n\n## Contributing\n\nRule authoring, the verification gates (including real-deploy reproduction), and the test layout are documented in [AGENTS.md](AGENTS.md) — written for AI coding agents and humans alike.\n\n## License\n\nApache-2.0\n"
+    "markdown": "# cdk-preflight\n\n[![monthly real-deploy verification](https://github.com/badmintoncryer/cdk-preflight/actions/workflows/monthly-verify.yml/badge.svg)](https://github.com/badmintoncryer/cdk-preflight/actions/workflows/monthly-verify.yml)\n\n**Catch deploy-time CloudFormation failures at `cdk synth` time.**\n\nSome CloudFormation constraints are not expressed in resource provider schemas — they live only in documentation, in service API validation, or across multiple properties. Templates that violate them pass `cdk synth`, pass CloudFormation pre-deployment validation, and then fail minutes into a deployment, burning a rollback cycle.\n\ncdk-preflight is a curated [Rego rule pack](docs/rules.md) for exactly those constraints, evaluated with the CloudFormation validation engine that ships inside `aws-cdk-lib` (>= 2.267.0). By default a violation **fails `cdk synth`** — a template that is known to fail at deploy time never leaves your machine.\n\nThe pack aims at **every deploy-time failure that no existing CDK mechanism already catches** — nothing narrower. Every bundled rule is backed by a `fail`/`pass` template pair, and the failure has been reproduced against real AWS (or is explicitly marked `doc-only`). Rules that the built-in validation engine already covers are deliberately **not** duplicated — a test suite enforces this.\n\n> **Requires `aws-cdk-lib` >= 2.267.0** (released 2026-08-27) — the first release that bundles\n> the CloudFormation validation engine. On older versions the rules cannot run at all.\n\n## Quick start\n\n```bash\nnpm i -D cdk-preflight\nnpx cdkpf init   # inserts Preflight.apply(app) into your CDK app\n                         # (`npx cdkpf init` is the same command, shorter)\n```\n\nor add one line yourself:\n\n```ts\nimport { Preflight } from 'cdk-preflight';\n\nconst app = new App();\nPreflight.apply(app);\n```\n\nOn violation, `cdk synth` fails with one error per finding, including the construct trace:\n\n```text\nERROR idle_timeout.timeout_seconds is 5000 but must be between 1 and 4000 seconds (cdk-preflight)\n   MyStack/Alb/Resource (Alb16C2F182) aws-cdk-lib.aws_elasticloadbalancingv2.CfnLoadBalancer\n\nSynthesis finished with errors\n```\n\n## Observe-only mode\n\nTo roll the rules out gradually, start with `enforce: false`: findings then surface as synth **warnings** through the CDK built-in validator, with construct traces and per-finding acknowledgement:\n\n```ts\nPreflight.apply(app, { enforce: false });\n```\n\n```text\nWARNING idle_timeout.timeout_seconds is 5000 but must be between 1 and 4000 seconds (CloudFormation Validate)\n   MyStack/Alb (Alb) aws-cdk-lib.aws_elasticloadbalancingv2.CfnLoadBalancer\n   Acknowledge with 'CloudFormation-Validate::pf-elbv2-lb-idle-timeout-range'\n```\n\n> **Known limitation with stages.** The AWS CDK CLI drops validation findings for stacks nested in a `Stage`\n> before printing them, so in observe-only mode those findings appear **only** in `cdk.out/validation-report.json`\n> and never on the console. Enforce mode is not affected: cdk-preflight reports such findings itself and fails\n> synthesis. This is a CLI-side bug (present since aws-cdk 2.1128.1), not a rule evaluation problem.\n\n| Option | Default | Effect |\n|---|---|---|\n| `enforce` | `true` | Violations of bundled rules fail synthesis; set to `false` to only warn |\n| `strict` | `false` | With `enforce`: also fail on error-class findings (`ERROR`/`FATAL`, e.g. `F3034`) of the built-in validation engine itself, which the CDK currently downgrades to warnings |\n| `exclude` | `[]` | Rule ids to disable |\n| `includeUpstreamPending` | `true` | Include rules already proposed to the upstream engine but not yet merged |\n\nTo opt out of a single rule, pass its id in `exclude`. In observe-only mode, individual findings can also be suppressed with the CDK acknowledge mechanism shown in the warning text.\n\n## Bundled rules\n\nSee [docs/rules.md](docs/rules.md) for the generated rule table. Highlights:\n\n- **ELBv2**: `idle_timeout` / `deregistration_delay` / `slow_start` attribute ranges (stringly-typed Key/Value attributes are invisible to schema validation)\n- **IAM**: managed (6,144 chars) and inline (role/group/user) policy document size limits\n- **CloudFront**: `MinTTL <= DefaultTTL <= MaxTTL` ordering, ACM certificates must live in `us-east-1`\n- **Step Functions**: `Next`/`Default`/`Choices` must reference defined states (a dangling `StartAt` is already caught by the engine's built-in `E3601`)\n- **EC2**: security group TCP/UDP port ranges and `FromPort <= ToPort`\n\n## For AI agents\n\nTo add cdk-preflight to a CDK app:\n\n1. `npm i -D cdk-preflight`\n2. `npx cdk-preflight init` — or the shorter alias `npx cdkpf init` (finds the entry point via `cdk.json` and inserts `Preflight.apply(app)`; use `--dry-run` to preview)\n3. Run `cdk synth`. Violations fail the synth with a validation report; each finding carries a rule id, the actual value, and a suggested fix\n4. To fix a finding, prefer correcting the resource. To opt out instead: `exclude: ['<rule-id>']` disables one rule, `enforce: false` switches to warn-only reporting\n\nThe machine-readable findings are written to `cdk.out/validation-report.json` when synthesizing with `-c @aws-cdk/core:validationReportJson=true`.\n\n### Report missed deploy errors\n\ncdk-preflight only knows the failure modes it has benched. When a deploy fails on a constraint the pack should have caught, that report is how new rules get added — but at that moment cdk-preflight is out of the loop (it passed the synth), so the instruction has to already sit in your agent's context. Paste this into your repository's `AGENTS.md` (or `CLAUDE.md`):\n\n```markdown\n## cdk-preflight: report missed deploy errors\n\nIf `cdk deploy` fails even though `cdk synth` (with cdk-preflight enabled) passed,\nand the failure is a service-side validation rejection — CREATE_FAILED/UPDATE_FAILED\nwith a 400-class message such as \"Invalid request provided: ...\" — cdk-preflight is\nmissing a rule. Report it:\n\n1. Qualify first. NOT reportable: AccessDenied / permissions, service quotas,\n   throttling, name conflicts with existing resources, stabilization timeouts.\n2. Redact account-specific data (account IDs -> 123456789012, real ARNs/domains\n   -> placeholders).\n3. Search existing issues: https://github.com/badmintoncryer/cdk-preflight/issues\n4. With your user's approval, open a \"Missed deploy error\" issue with the verbatim\n   error message, the resource type, a minimal template snippet, and your\n   aws-cdk-lib / cdk-preflight versions.\n```\n\n## Scope and rule lifecycle\n\nA constraint belongs in the pack when violating it makes a real deployment fail *and* no layer that sees the same synthesized template already blocks it. There is no further \"is this worth a rule\" question — if the gap is real, it gets a rule.\n\nCDK L2 construct validation is deliberately **not** one of those layers. `CfnXxx` usage, escape hatches, `addPropertyOverride`, `cloudformation-include` and migrated templates all bypass L2, so an L2 guard covering the same mistake neither disqualifies a rule nor retires one.\n\nThat makes growth the normal state, and it has a consequence worth knowing before you upgrade: **new rules land in minor releases, so a minor upgrade can newly fail a `cdk synth` that passed yesterday.** That is intended, not a regression. If you need a frozen rule set, pin the version; to drop a single rule, `exclude: ['<rule-id>']`; to see everything without failing the build, `enforce: false`.\n\nRules move the other way too. Once the validation engine bundled in `aws-cdk-lib` (or CloudFormation's own pre-deploy validation) starts blocking a constraint, the rule is deleted rather than kept as a duplicate — staying on an older `aws-cdk-lib` and an older cdk-preflight keeps the old behavior.\n\n## How it works\n\n`Preflight.apply()` evaluates the rules with the [cloudformation-validate](https://github.com/aws-cloudformation/cloudformation-validate) Rust/WASM engine that ships inside `aws-cdk-lib` — no extra binaries, no network access at synth time. In the default enforce mode the engine is invoked through a dedicated CDK validation plugin so that violations fail synthesis; with `enforce: false` the rules are instead injected into the CDK built-in `CloudFormationValidatePlugin` and reported as warnings.\n\nConstraints that *can* be expressed in schemas or generic engine rules also make good upstream PRs to that engine, but nothing here waits on one — the upstream release cycle is deliberately slower than this pack's. Each rule's `meta.yaml` tracks its upstream status so that retirement stays bookkeeping.\n\n## Requirements\n\n- `aws-cdk-lib` >= 2.267.0, released 2026-08-27 (the first release that bundles the built-in CloudFormation validator). This is a recent release — an existing CDK app may need an upgrade before cdk-preflight can run.\n\n## Contributing\n\nRule authoring, the verification gates (including real-deploy reproduction), and the test layout are documented in [AGENTS.md](AGENTS.md) — written for AI coding agents and humans alike.\n\n## License\n\nApache-2.0\n"
   },
   "repository": {
     "type": "git",
@@ -9481,7 +9481,7 @@
           },
           "locationInModule": {
             "filename": "src/index.ts",
-            "line": 97
+            "line": 98
           },
           "name": "ruleIds",
           "returns": {
@@ -9599,6 +9599,6 @@
       "symbolId": "src/index:PreflightOptions"
     }
   },
-  "version": "0.0.47",
-  "fingerprint": "GyTHbOCcgH07cq0PZQnBXZi7Kr3ztgKxn7vqOZ3mcxI="
+  "version": "0.0.49",
+  "fingerprint": "c/rzd3OU6IXjSrjl6PcnuHY81yzNwl+NV2LFlEL2KsE="
 }

package/README.md

@@ -53,6 +53,11 @@ WARNING idle_timeout.timeout_seconds is 5000 but must be between 1 and 4000 seco
    Acknowledge with 'CloudFormation-Validate::pf-elbv2-lb-idle-timeout-range'
 ```
 
+> **Known limitation with stages.** The AWS CDK CLI drops validation findings for stacks nested in a `Stage`
+> before printing them, so in observe-only mode those findings appear **only** in `cdk.out/validation-report.json`
+> and never on the console. Enforce mode is not affected: cdk-preflight reports such findings itself and fails
+> synthesis. This is a CLI-side bug (present since aws-cdk 2.1128.1), not a rule evaluation problem.
+
 | Option | Default | Effect |
 |---|---|---|
 | `enforce` | `true` | Violations of bundled rules fail synthesis; set to `false` to only warn |

package/docs/rules.md

@@ -437,17 +437,85 @@
 | `pf-route53-weight-range` | AWS::Route53::RecordSet | Weight must be between 0 and 255 | pending-engine |
 | `pf-route53-zonename-trailing-dot` | AWS::Route53::RecordSet | HostedZoneName must end with a trailing dot | none |
 | `pf-s3-accelerate-dotted-name` | AWS::S3::Bucket | Transfer Acceleration rejects bucket names with periods | none |
+| `pf-s3-acl-public-blocked` | AWS::S3::Bucket | A public canned ACL cannot be applied while Block Public Access is on | none |
+| `pf-s3-ap-name-alias-suffix` | AWS::S3::AccessPoint | An access point name must not end with an alias suffix | none |
+| `pf-s3-bucket-name-double-dot` | AWS::S3::Bucket | A bucket name must not contain two adjacent periods | none |
+| `pf-s3-bucket-name-ip-address` | AWS::S3::Bucket | A bucket name must not look like an IP address | none |
+| `pf-s3-bucket-name-reserved-prefix` | AWS::S3::Bucket | A bucket name must not start with a reserved prefix | none |
+| `pf-s3-bucket-name-reserved-suffix` | AWS::S3::Bucket | A bucket name must not end with a reserved suffix | none |
+| `pf-s3-bucket-namespace-account-regional-name` | AWS::S3::Bucket | An account-regional bucket takes a BucketNamePrefix, not a BucketName | none |
 | `pf-s3-bucket-policy-action-resource` | AWS::S3::BucketPolicy | Object-level actions need an object-level Resource | none |
 | `pf-s3-bucket-policy-principal` | AWS::S3::BucketPolicy | Bucket policy statements need a Principal | none |
+| `pf-s3-bucket-policy-version` | AWS::S3::BucketPolicy | A policy document Version must be a known IAM policy language version | none |
+| `pf-s3-encryption-kms-key-with-aes256` | AWS::S3::Bucket | KMSMasterKeyID is only valid with a KMS server-side encryption algorithm | none |
+| `pf-s3-intelligent-tiering-archive-before-deep` | AWS::S3::Bucket | ARCHIVE_ACCESS must come before DEEP_ARCHIVE_ACCESS | none |
+| `pf-s3-intelligent-tiering-duplicate-tier` | AWS::S3::Bucket | An Intelligent-Tiering configuration must not repeat an access tier | none |
+| `pf-s3-lifecycle-abort-mpu-with-tag-filter` | AWS::S3::Bucket | AbortIncompleteMultipartUpload cannot be used in a tag-filtered rule | none |
+| `pf-s3-lifecycle-date-days-mix` | AWS::S3::Bucket | A lifecycle rule must not mix day-based and date-based schedules | none |
+| `pf-s3-lifecycle-date-midnight-utc` | AWS::S3::Bucket | Lifecycle dates must be UTC midnight | none |
 | `pf-s3-lifecycle-days-order` | AWS::S3::Bucket | Lifecycle archive transitions must come 30+ days after IA, and expiration after every transition | none |
+| `pf-s3-lifecycle-delete-marker-exclusive` | AWS::S3::Bucket | ExpiredObjectDeleteMarker cannot be combined with an expiration or a tag filter | none |
 | `pf-s3-lifecycle-expiration-positive` | AWS::S3::Bucket | ExpirationInDays must be a positive integer | pending-engine |
+| `pf-s3-lifecycle-min-storage-duration-chain` | AWS::S3::Bucket | A transition must wait out the minimum storage duration of the class it leaves | none |
+| `pf-s3-lifecycle-object-size-order` | AWS::S3::Bucket | ObjectSizeGreaterThan must be smaller than ObjectSizeLessThan | none |
+| `pf-s3-lifecycle-rule-id-duplicate` | AWS::S3::Bucket | Lifecycle rule ids must be unique within a bucket | none |
 | `pf-s3-lifecycle-rule-no-action` | AWS::S3::Bucket | A lifecycle rule needs at least one action | none |
+| `pf-s3-lifecycle-tag-key-duplicate` | AWS::S3::Bucket | Lifecycle tag filter keys must be unique within a rule | none |
+| `pf-s3-lifecycle-transition-singular-plural-exclusive` | AWS::S3::Bucket | A lifecycle rule must not use both the singular and the plural transition property | none |
+| `pf-s3-lifecycle-transition-storage-class-duplicate` | AWS::S3::Bucket | A lifecycle rule must not transition to the same storage class twice | none |
+| `pf-s3-lifecycle-transition-waterfall-order` | AWS::S3::Bucket | Lifecycle transitions may only move down the storage-class waterfall | none |
+| `pf-s3-metadata-kms-requires-key` | AWS::S3::Bucket | A KMS-encrypted metadata table needs a KmsKeyArn | none |
+| `pf-s3-metadata-record-expiration-days` | AWS::S3::Bucket | Metadata journal record expiration must be at least 7 days | none |
+| `pf-s3-metadata-v1-v2-exclusive` | AWS::S3::Bucket | MetadataConfiguration and MetadataTableConfiguration cannot both be set | none |
+| `pf-s3-notification-destination-region` | AWS::S3::Bucket | A notification destination must live in the bucket region | none |
+| `pf-s3-notification-duplicate-filter-type` | AWS::S3::Bucket | A notification filter may hold one prefix rule and one suffix rule | none |
+| `pf-s3-notification-event-name` | AWS::S3::Bucket | The notification Event must be an S3 event type | none |
+| `pf-s3-notification-fifo-queue` | AWS::S3::Bucket | S3 event notifications cannot target a FIFO SQS queue | none |
+| `pf-s3-notification-fifo-topic` | AWS::S3::Bucket | S3 event notifications cannot target a FIFO SNS topic | none |
 | `pf-s3-notification-overlapping-filters` | AWS::S3::Bucket | Notification entries must not overlap for the same event type | none |
 | `pf-s3-objectlock-requires-versioning` | AWS::S3::Bucket | ObjectLockConfiguration needs versioning enabled | none |
+| `pf-s3-objectlock-retention-days-years-exclusive` | AWS::S3::Bucket | DefaultRetention takes exactly one of Days or Years | none |
 | `pf-s3-objectlock-versioning-suspended` | AWS::S3::Bucket | Object Lock forbids suspending versioning | none |
+| `pf-s3-policy-public-with-block-public-policy` | AWS::S3::BucketPolicy<br>AWS::S3::Bucket | A public bucket policy cannot be put on a bucket that blocks public policies | none |
+| `pf-s3-replication-acl-translation-needs-account` | AWS::S3::Bucket | AccessControlTranslation requires the destination Account | none |
 | `pf-s3-replication-dest-versioning` | AWS::S3::Bucket | The replication destination bucket needs versioning enabled | none |
+| `pf-s3-replication-destination-bucket-arn` | AWS::S3::Bucket | The replication destination must be a bucket ARN, not a bucket name | none |
+| `pf-s3-replication-filter-requires-delete-marker` | AWS::S3::Bucket | A V2 replication rule with a Filter must also set Priority and DeleteMarkerReplication | none |
+| `pf-s3-replication-priority-duplicate` | AWS::S3::Bucket | Replication rule priorities must be unique | none |
 | `pf-s3-replication-requires-versioning` | AWS::S3::Bucket | ReplicationConfiguration requires versioning to be enabled on the source bucket | none |
+| `pf-s3-replication-rtc-minutes-15` | AWS::S3::Bucket | Replication Time Control accepts only 15 minutes | none |
+| `pf-s3-replication-rtc-needs-metrics` | AWS::S3::Bucket | Replication Time Control needs Metrics, and Metrics needs ReplicationTime | none |
+| `pf-s3-replication-sse-kms-needs-replica-key` | AWS::S3::Bucket | Replicating SSE-KMS objects requires a replica KMS key | none |
+| `pf-s3-replication-tag-filter-delete-marker` | AWS::S3::Bucket | A tag-filtered replication rule must disable delete marker replication | none |
+| `pf-s3-replication-v1-v2-mixed` | AWS::S3::Bucket | A replication rule must not mix the V1 Prefix with the V2 Filter | none |
+| `pf-s3-storagelens-bucket-level-needs-account-level` | AWS::S3::StorageLens | A bucket-level advanced metric must also be enabled at the account level | none |
+| `pf-s3-storagelens-buckets-arn` | AWS::S3::StorageLens | Storage Lens scope buckets are given as ARNs | none |
+| `pf-s3-storagelens-include-empty` | AWS::S3::StorageLens | A Storage Lens Include or Exclude must list at least one bucket or region | none |
+| `pf-s3-storagelens-include-exclude-exclusive` | AWS::S3::StorageLens | A Storage Lens configuration takes either Include or Exclude | none |
+| `pf-s3-storagelens-prefix-delimiter-length` | AWS::S3::StorageLens | PrefixDelimiter is a single character | none |
+| `pf-s3-storagelensgroup-match-any-max` | AWS::S3::StorageLensGroup | A Storage Lens group match list holds at most 10 entries | none |
+| `pf-s3-storagelensgroup-object-age-order` | AWS::S3::StorageLensGroup | MatchObjectAge DaysGreaterThan must be smaller than DaysLessThan | none |
+| `pf-s3-storagelensgroup-object-size-order` | AWS::S3::StorageLensGroup | MatchObjectSize BytesGreaterThan must be smaller than BytesLessThan | none |
+| `pf-s3-versioning-suspended-with-replication` | AWS::S3::Bucket | A replicating bucket must keep versioning enabled | none |
+| `pf-s3-website-empty-condition` | AWS::S3::Bucket | A RoutingRuleCondition needs a key prefix or an HTTP error code | none |
+| `pf-s3-website-empty-redirect-rule` | AWS::S3::Bucket | A RedirectRule must carry at least one element | none |
 | `pf-s3-website-redirect-exclusive` | AWS::S3::Bucket | RedirectAllRequestsTo excludes every other website setting | none |
+| `pf-s3-website-replace-key-exclusive` | AWS::S3::Bucket | ReplaceKeyWith and ReplaceKeyPrefixWith are mutually exclusive | none |
+| `pf-s3-website-routing-rules-need-index` | AWS::S3::Bucket | RoutingRules require an IndexDocument | none |
+| `pf-s3express-ap-name-suffix` | AWS::S3Express::AccessPoint | An S3 Express access point name must end with --<availability-zone-id>--xa-s3 | none |
+| `pf-s3express-ap-scope-permissions` | AWS::S3Express::AccessPoint | Access point scope permissions are bare API names, not s3: actions | none |
+| `pf-s3express-ap-zone-mismatch` | AWS::S3Express::AccessPoint | An S3 Express access point must carry the same zone id as its bucket | none |
+| `pf-s3express-bucket-key-enabled-false` | AWS::S3Express::DirectoryBucket | A directory bucket must keep BucketKeyEnabled true | none |
+| `pf-s3express-bucket-location-region` | AWS::S3Express::DirectoryBucket | LocationName must name a zone in the region the stack deploys to | none |
+| `pf-s3express-bucket-name-dot` | AWS::S3Express::DirectoryBucket | A directory bucket name must not contain a period | none |
+| `pf-s3express-bucket-name-reserved-prefix` | AWS::S3Express::DirectoryBucket | A directory bucket name must not start with a reserved prefix | none |
+| `pf-s3express-bucket-name-suffix` | AWS::S3Express::DirectoryBucket | A directory bucket name must end with --<availability-zone-id>--x-s3 | none |
+| `pf-s3express-bucket-redundancy-location` | AWS::S3Express::DirectoryBucket | DataRedundancy must match the kind of zone LocationName names | none |
+| `pf-s3express-bucket-zone-mismatch` | AWS::S3Express::DirectoryBucket | The zone id in a directory bucket name must equal LocationName | none |
+| `pf-s3express-kms-key-alias` | AWS::S3Express::DirectoryBucket | A directory bucket KMS key must be given as a key id or ARN, not an alias | none |
+| `pf-s3express-kms-key-with-aes256` | AWS::S3Express::DirectoryBucket | KMSMasterKeyID is only valid when SSEAlgorithm is aws:kms | none |
+| `pf-s3express-lifecycle-object-size-order` | AWS::S3Express::DirectoryBucket | ObjectSizeGreaterThan must be smaller than ObjectSizeLessThan | none |
+| `pf-s3express-lifecycle-rule-no-action` | AWS::S3Express::DirectoryBucket | A directory bucket lifecycle rule must declare an expiration or an abort action | none |
 | `pf-scheduler-flexible-window` | AWS::Scheduler::Schedule | FLEXIBLE mode needs MaximumWindowInMinutes, OFF forbids it | none |
 | `pf-scheduler-rate-positive` | AWS::Scheduler::Schedule | A Scheduler rate() value must be positive | none |
 | `pf-secretsmanager-generate-secret-string` | AWS::SecretsManager::Secret | GenerateSecretString must leave at least one character type, a PasswordLength (1..4096) that fits every required type, ExcludeCharacters under 4096 chars that does not wipe out a required type, and SecretStringTemplate (a JSON object) together with GenerateStringKey | none |

package/lib/index.js

@@ -17,7 +17,7 @@ const rules_generated_1 = require("./rules.generated");
  * Preflight.apply(app);
  */
 class Preflight {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "0.0.47" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-preflight.Preflight", version: "0.0.49" };
     /**
      * Register the cdk-preflight rules on an App or Stage.
      */
@@ -35,6 +35,7 @@ class Preflight {
             .filter((r) => !exclude.includes(r.id));
         if (options.enforce ?? true) {
             aws_cdk_lib_1.Validations.of(scope).addPlugins(new enforce_1.PreflightEnforcePlugin(selected, options.strict ?? false));
+            (0, enforce_1.installEnforceGate)(scope);
         }
         else {
             aws_cdk_lib_1.Validations.of(scope).addPlugins(new aws_cdk_lib_1.CloudFormationValidatePlugin({
@@ -54,4 +55,4 @@ class Preflight {
     constructor() { }
 }
 exports.Preflight = Preflight;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7OztBQUFBLDZDQUErRTtBQUUvRSwrQ0FBMkQ7QUFDM0QsdURBQWdFO0FBa0RoRTs7Ozs7Ozs7OztHQVVHO0FBQ0gsTUFBYSxTQUFTOztJQUNwQjs7T0FFRztJQUNJLE1BQU0sQ0FBQyxLQUFLLENBQUMsS0FBaUIsRUFBRSxVQUE0QixFQUFFO1FBQ25FLElBQUksQ0FBQyxtQkFBSyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQzFCLE1BQU0sSUFBSSxLQUFLLENBQUMsc0VBQXNFLENBQUMsQ0FBQztRQUMxRixDQUFDO1FBQ0QsTUFBTSxPQUFPLEdBQUcsT0FBTyxDQUFDLE9BQU8sSUFBSSxFQUFFLENBQUM7UUFDdEMsTUFBTSxPQUFPLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQUFDLEVBQUUsRUFBRSxFQUFFLENBQUMsQ0FBQywrQkFBYSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQyxDQUFDO1FBQ2hGLElBQUksT0FBTyxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUN2QixNQUFNLElBQUksS0FBSyxDQUFDLGlEQUFpRCxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUN6RixDQUFDO1FBQ0QsTUFBTSxRQUFRLEdBQUcsK0JBQWE7YUFDM0IsTUFBTSxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxzQkFBc0IsSUFBSSxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUMsUUFBUSxLQUFLLGdCQUFnQixDQUFDO2FBQzFGLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDO1FBRTFDLElBQUksT0FBTyxDQUFDLE9BQU8sSUFBSSxJQUFJLEVBQUUsQ0FBQztZQUM1Qix5QkFBVyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxVQUFVLENBQUMsSUFBSSxnQ0FBc0IsQ0FBQyxRQUFRLEVBQUUsT0FBTyxDQUFDLE1BQU0sSUFBSSxLQUFLLENBQUMsQ0FBQyxDQUFDO1FBQ2xHLENBQUM7YUFBTSxDQUFDO1lBQ04seUJBQVcsQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLENBQUMsVUFBVSxDQUFDLElBQUksMENBQTRCLENBQUM7Z0JBQ2hFLFNBQVMsRUFBRTtvQkFDVCxHQUFHLDhCQUFZLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQyxJQUFJLEVBQUUsT0FBTyxFQUFFLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDO29CQUMvRCxHQUFHLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDLEVBQUUsRUFBRSxPQUFPLEVBQUUsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDLENBQUM7aUJBQzFEO2FBQ0YsQ0FBQyxDQUFDLENBQUM7UUFDTixDQUFDO0lBQ0gsQ0FBQztJQUVEOztPQUVHO0lBQ0ksTUFBTSxDQUFDLE9BQU87UUFDbkIsT0FBTywrQkFBYSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQ3hDLENBQUM7SUFFRCxnQkFBdUIsQ0FBQzs7QUFwQzFCLDhCQXFDQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IENsb3VkRm9ybWF0aW9uVmFsaWRhdGVQbHVnaW4sIFN0YWdlLCBWYWxpZGF0aW9ucyB9IGZyb20gJ2F3cy1jZGstbGliJztcbmltcG9ydCB7IElDb25zdHJ1Y3QgfSBmcm9tICdjb25zdHJ1Y3RzJztcbmltcG9ydCB7IFByZWZsaWdodEVuZm9yY2VQbHVnaW4gfSBmcm9tICcuL3ByaXZhdGUvZW5mb3JjZSc7XG5pbXBvcnQgeyBCVU5ETEVEX0xJQlMsIEJVTkRMRURfUlVMRVMgfSBmcm9tICcuL3J1bGVzLmdlbmVyYXRlZCc7XG5cbi8qKlxuICogT3B0aW9ucyBmb3Ige0BsaW5rIFByZWZsaWdodC5hcHBseX0uXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgUHJlZmxpZ2h0T3B0aW9ucyB7XG4gIC8qKlxuICAgKiBSdWxlIGlkcyB0byBkaXNhYmxlIChzZWUgYFByZWZsaWdodC5ydWxlSWRzKClgIG9yIGRvY3MvcnVsZXMubWQpLlxuICAgKlxuICAgKiBAZGVmYXVsdCAtIGFsbCBidW5kbGVkIHJ1bGVzIGFyZSBlbmFibGVkXG4gICAqL1xuICByZWFkb25seSBleGNsdWRlPzogc3RyaW5nW107XG5cbiAgLyoqXG4gICAqIEZhaWwgc3ludGhlc2lzIHdoZW4gYSBidW5kbGVkIHJ1bGUgaXMgdmlvbGF0ZWQuXG4gICAqXG4gICAqIEluIHRoZSBkZWZhdWx0IChlbmZvcmNlKSBtb2RlLCBjZGstcHJlZmxpZ2h0IGV2YWx1YXRlcyBpdHMgcnVsZXMgd2l0aCBpdHNcbiAgICogb3duIHZhbGlkYXRpb24gcGx1Z2luIGFuZCBhIHZpb2xhdGlvbiBtYWtlcyBgY2RrIHN5bnRoYCBmYWlsIOKAlCB0aGUgd2hvbGVcbiAgICogcG9pbnQgb2YgcHJlZmxpZ2h0IGNoZWNrcyBpcyB0aGF0IGEgdGVtcGxhdGUga25vd24gdG8gZmFpbCBhdCBkZXBsb3kgdGltZVxuICAgKiBuZXZlciBsZWF2ZXMgeW91ciBtYWNoaW5lLiBTZXQgYGVuZm9yY2U6IGZhbHNlYCB0byBvYnNlcnZlIGZpcnN0OiBmaW5kaW5nc1xuICAgKiBhcmUgdGhlbiByZXBvcnRlZCB0aHJvdWdoIHRoZSBDREsgYnVpbHQtaW4gQ2xvdWRGb3JtYXRpb24gdmFsaWRhdG9yIGFuZFxuICAgKiBzdXJmYWNlIGFzIHN5bnRoIHdhcm5pbmdzIHdpdGggY29uc3RydWN0IHRyYWNlcywgd2hpY2ggY2FuIGJlIG11dGVkIHBlclxuICAgKiBmaW5kaW5nIHZpYSBgQWNrbm93bGVkZ2Ugd2l0aCAnQ2xvdWRGb3JtYXRpb24tVmFsaWRhdGU6OjxydWxlLWlkPidgLlxuICAgKlxuICAgKiBAZGVmYXVsdCB0cnVlXG4gICAqL1xuICByZWFkb25seSBlbmZvcmNlPzogYm9vbGVhbjtcblxuICAvKipcbiAgICogSW4gZW5mb3JjZSBtb2RlLCBhZGRpdGlvbmFsbHkgZmFpbCBzeW50aGVzaXMgb24gZXJyb3ItY2xhc3MgZmluZGluZ3NcbiAgICogKHNldmVyaXR5IEVSUk9SL0ZBVEFMKSBvZiB0aGUgYnVpbHQtaW4gdmFsaWRhdGlvbiBlbmdpbmUgaXRzZWxmLCBlLmcuXG4gICAqIHNjaGVtYSB2aW9sYXRpb25zIGxpa2UgYEYzMDM0YC4gVGhpcyBpcyB0aGUgd29ya2Fyb3VuZCBmb3IgdGhlIENES1xuICAgKiBiZWhhdmlvciB3aGVyZSBhbGwgYnVpbHQtaW4gZmluZGluZ3MgYXJlIGRvd25ncmFkZWQgdG8gd2FybmluZ3MuXG4gICAqXG4gICAqIE9ubHkgZWZmZWN0aXZlIGluIGVuZm9yY2UgbW9kZSAodGhlIGRlZmF1bHQpLlxuICAgKlxuICAgKiBAZGVmYXVsdCBmYWxzZVxuICAgKi9cbiAgcmVhZG9ubHkgc3RyaWN0PzogYm9vbGVhbjtcblxuICAvKipcbiAgICogSW5jbHVkZSBydWxlcyB0aGF0IGFyZSBtYXJrZWQgYHBlbmRpbmctZW5naW5lYCAoY2FuZGlkYXRlcyB0aGF0IGhhdmUgYmVlblxuICAgKiBwcm9wb3NlZCB0byB0aGUgdXBzdHJlYW0gY2xvdWRmb3JtYXRpb24tdmFsaWRhdGUgZW5naW5lIGJ1dCBhcmUgbm90IG1lcmdlZFxuICAgKiB5ZXQpLiBEaXNhYmxlIHRoaXMgaWYgeW91IHJ1biBhIG5ld2VyIGVuZ2luZSB0aGF0IGFscmVhZHkgY292ZXJzIHRoZW0uXG4gICAqXG4gICAqIEBkZWZhdWx0IHRydWVcbiAgICovXG4gIHJlYWRvbmx5IGluY2x1ZGVVcHN0cmVhbVBlbmRpbmc/OiBib29sZWFuO1xufVxuXG4vKipcbiAqIGNkay1wcmVmbGlnaHQ6IGNhdGNoIGRlcGxveS10aW1lIENsb3VkRm9ybWF0aW9uIGZhaWx1cmVzIGF0IHN5bnRoIHRpbWUuXG4gKlxuICogSW5qZWN0cyBhIGN1cmF0ZWQgUmVnbyBydWxlIHBhY2sgKGNvbnN0cmFpbnRzIHRoYXQgcmVzb3VyY2UgcHJvdmlkZXIgc2NoZW1hc1xuICogZG8gbm90IGV4cHJlc3M6IGRvYy1vbmx5IHZhbHVlIGxpbWl0cywgY3Jvc3MtcHJvcGVydHkgYW5kIGNyb3NzLXJlc291cmNlXG4gKiBydWxlcykgaW50byB0aGUgQVdTIENESyBidWlsdC1pbiBDbG91ZEZvcm1hdGlvbiB2YWxpZGF0b3IuXG4gKlxuICogQGV4YW1wbGVcbiAqIGRlY2xhcmUgY29uc3QgYXBwOiBBcHA7XG4gKiBQcmVmbGlnaHQuYXBwbHkoYXBwKTtcbiAqL1xuZXhwb3J0IGNsYXNzIFByZWZsaWdodCB7XG4gIC8qKlxuICAgKiBSZWdpc3RlciB0aGUgY2RrLXByZWZsaWdodCBydWxlcyBvbiBhbiBBcHAgb3IgU3RhZ2UuXG4gICAqL1xuICBwdWJsaWMgc3RhdGljIGFwcGx5KHNjb3BlOiBJQ29uc3RydWN0LCBvcHRpb25zOiBQcmVmbGlnaHRPcHRpb25zID0ge30pOiB2b2lkIHtcbiAgICBpZiAoIVN0YWdlLmlzU3RhZ2Uoc2NvcGUpKSB7XG4gICAgICB0aHJvdyBuZXcgRXJyb3IoJ2Nkay1wcmVmbGlnaHQ6IFByZWZsaWdodC5hcHBseSgpIG11c3QgYmUgY2FsbGVkIG9uIGFuIEFwcCBvciBhIFN0YWdlJyk7XG4gICAgfVxuICAgIGNvbnN0IGV4Y2x1ZGUgPSBvcHRpb25zLmV4Y2x1ZGUgPz8gW107XG4gICAgY29uc3QgdW5rbm93biA9IGV4Y2x1ZGUuZmlsdGVyKChpZCkgPT4gIUJVTkRMRURfUlVMRVMuc29tZSgocikgPT4gci5pZCA9PT0gaWQpKTtcbiAgICBpZiAodW5rbm93bi5sZW5ndGggPiAwKSB7XG4gICAgICB0aHJvdyBuZXcgRXJyb3IoYGNkay1wcmVmbGlnaHQ6IHVua25vd24gcnVsZSBpZChzKSBpbiBleGNsdWRlOiAke3Vua25vd24uam9pbignLCAnKX1gKTtcbiAgICB9XG4gICAgY29uc3Qgc2VsZWN0ZWQgPSBCVU5ETEVEX1JVTEVTXG4gICAgICAuZmlsdGVyKChyKSA9PiAob3B0aW9ucy5pbmNsdWRlVXBzdHJlYW1QZW5kaW5nID8/IHRydWUpIHx8IHIudXBzdHJlYW0gIT09ICdwZW5kaW5nLWVuZ2luZScpXG4gICAgICAuZmlsdGVyKChyKSA9PiAhZXhjbHVkZS5pbmNsdWRlcyhyLmlkKSk7XG5cbiAgICBpZiAob3B0aW9ucy5lbmZvcmNlID8/IHRydWUpIHtcbiAgICAgIFZhbGlkYXRpb25zLm9mKHNjb3BlKS5hZGRQbHVnaW5zKG5ldyBQcmVmbGlnaHRFbmZvcmNlUGx1Z2luKHNlbGVjdGVkLCBvcHRpb25zLnN0cmljdCA/PyBmYWxzZSkpO1xuICAgIH0gZWxzZSB7XG4gICAgICBWYWxpZGF0aW9ucy5vZihzY29wZSkuYWRkUGx1Z2lucyhuZXcgQ2xvdWRGb3JtYXRpb25WYWxpZGF0ZVBsdWdpbih7XG4gICAgICAgIHJlZ29SdWxlczogW1xuICAgICAgICAgIC4uLkJVTkRMRURfTElCUy5tYXAoKGwpID0+ICh7IG5hbWU6IGwubmFtZSwgY29udGVudDogbC5yZWdvIH0pKSxcbiAgICAgICAgICAuLi5zZWxlY3RlZC5tYXAoKHIpID0+ICh7IG5hbWU6IHIuaWQsIGNvbnRlbnQ6IHIucmVnbyB9KSksXG4gICAgICAgIF0sXG4gICAgICB9KSk7XG4gICAgfVxuICB9XG5cbiAgLyoqXG4gICAqIFRoZSBpZHMgb2YgYWxsIGJ1bmRsZWQgcnVsZXMuXG4gICAqL1xuICBwdWJsaWMgc3RhdGljIHJ1bGVJZHMoKTogc3RyaW5nW10ge1xuICAgIHJldHVybiBCVU5ETEVEX1JVTEVTLm1hcCgocikgPT4gci5pZCk7XG4gIH1cblxuICBwcml2YXRlIGNvbnN0cnVjdG9yKCkge31cbn1cbiJdfQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7OztBQUFBLDZDQUErRTtBQUUvRSwrQ0FBK0U7QUFDL0UsdURBQWdFO0FBa0RoRTs7Ozs7Ozs7OztHQVVHO0FBQ0gsTUFBYSxTQUFTOztJQUNwQjs7T0FFRztJQUNJLE1BQU0sQ0FBQyxLQUFLLENBQUMsS0FBaUIsRUFBRSxVQUE0QixFQUFFO1FBQ25FLElBQUksQ0FBQyxtQkFBSyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQzFCLE1BQU0sSUFBSSxLQUFLLENBQUMsc0VBQXNFLENBQUMsQ0FBQztRQUMxRixDQUFDO1FBQ0QsTUFBTSxPQUFPLEdBQUcsT0FBTyxDQUFDLE9BQU8sSUFBSSxFQUFFLENBQUM7UUFDdEMsTUFBTSxPQUFPLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQUFDLEVBQUUsRUFBRSxFQUFFLENBQUMsQ0FBQywrQkFBYSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQyxDQUFDO1FBQ2hGLElBQUksT0FBTyxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUN2QixNQUFNLElBQUksS0FBSyxDQUFDLGlEQUFpRCxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUN6RixDQUFDO1FBQ0QsTUFBTSxRQUFRLEdBQUcsK0JBQWE7YUFDM0IsTUFBTSxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxzQkFBc0IsSUFBSSxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUMsUUFBUSxLQUFLLGdCQUFnQixDQUFDO2FBQzFGLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDO1FBRTFDLElBQUksT0FBTyxDQUFDLE9BQU8sSUFBSSxJQUFJLEVBQUUsQ0FBQztZQUM1Qix5QkFBVyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxVQUFVLENBQUMsSUFBSSxnQ0FBc0IsQ0FBQyxRQUFRLEVBQUUsT0FBTyxDQUFDLE1BQU0sSUFBSSxLQUFLLENBQUMsQ0FBQyxDQUFDO1lBQ2hHLElBQUEsNEJBQWtCLEVBQUMsS0FBSyxDQUFDLENBQUM7UUFDNUIsQ0FBQzthQUFNLENBQUM7WUFDTix5QkFBVyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxVQUFVLENBQUMsSUFBSSwwQ0FBNEIsQ0FBQztnQkFDaEUsU0FBUyxFQUFFO29CQUNULEdBQUcsOEJBQVksQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDLElBQUksRUFBRSxPQUFPLEVBQUUsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDLENBQUM7b0JBQy9ELEdBQUcsUUFBUSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxFQUFFLElBQUksRUFBRSxDQUFDLENBQUMsRUFBRSxFQUFFLE9BQU8sRUFBRSxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQztpQkFDMUQ7YUFDRixDQUFDLENBQUMsQ0FBQztRQUNOLENBQUM7SUFDSCxDQUFDO0lBRUQ7O09BRUc7SUFDSSxNQUFNLENBQUMsT0FBTztRQUNuQixPQUFPLCtCQUFhLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDeEMsQ0FBQztJQUVELGdCQUF1QixDQUFDOztBQXJDMUIsOEJBc0NDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgQ2xvdWRGb3JtYXRpb25WYWxpZGF0ZVBsdWdpbiwgU3RhZ2UsIFZhbGlkYXRpb25zIH0gZnJvbSAnYXdzLWNkay1saWInO1xuaW1wb3J0IHsgSUNvbnN0cnVjdCB9IGZyb20gJ2NvbnN0cnVjdHMnO1xuaW1wb3J0IHsgaW5zdGFsbEVuZm9yY2VHYXRlLCBQcmVmbGlnaHRFbmZvcmNlUGx1Z2luIH0gZnJvbSAnLi9wcml2YXRlL2VuZm9yY2UnO1xuaW1wb3J0IHsgQlVORExFRF9MSUJTLCBCVU5ETEVEX1JVTEVTIH0gZnJvbSAnLi9ydWxlcy5nZW5lcmF0ZWQnO1xuXG4vKipcbiAqIE9wdGlvbnMgZm9yIHtAbGluayBQcmVmbGlnaHQuYXBwbHl9LlxuICovXG5leHBvcnQgaW50ZXJmYWNlIFByZWZsaWdodE9wdGlvbnMge1xuICAvKipcbiAgICogUnVsZSBpZHMgdG8gZGlzYWJsZSAoc2VlIGBQcmVmbGlnaHQucnVsZUlkcygpYCBvciBkb2NzL3J1bGVzLm1kKS5cbiAgICpcbiAgICogQGRlZmF1bHQgLSBhbGwgYnVuZGxlZCBydWxlcyBhcmUgZW5hYmxlZFxuICAgKi9cbiAgcmVhZG9ubHkgZXhjbHVkZT86IHN0cmluZ1tdO1xuXG4gIC8qKlxuICAgKiBGYWlsIHN5bnRoZXNpcyB3aGVuIGEgYnVuZGxlZCBydWxlIGlzIHZpb2xhdGVkLlxuICAgKlxuICAgKiBJbiB0aGUgZGVmYXVsdCAoZW5mb3JjZSkgbW9kZSwgY2RrLXByZWZsaWdodCBldmFsdWF0ZXMgaXRzIHJ1bGVzIHdpdGggaXRzXG4gICAqIG93biB2YWxpZGF0aW9uIHBsdWdpbiBhbmQgYSB2aW9sYXRpb24gbWFrZXMgYGNkayBzeW50aGAgZmFpbCDigJQgdGhlIHdob2xlXG4gICAqIHBvaW50IG9mIHByZWZsaWdodCBjaGVja3MgaXMgdGhhdCBhIHRlbXBsYXRlIGtub3duIHRvIGZhaWwgYXQgZGVwbG95IHRpbWVcbiAgICogbmV2ZXIgbGVhdmVzIHlvdXIgbWFjaGluZS4gU2V0IGBlbmZvcmNlOiBmYWxzZWAgdG8gb2JzZXJ2ZSBmaXJzdDogZmluZGluZ3NcbiAgICogYXJlIHRoZW4gcmVwb3J0ZWQgdGhyb3VnaCB0aGUgQ0RLIGJ1aWx0LWluIENsb3VkRm9ybWF0aW9uIHZhbGlkYXRvciBhbmRcbiAgICogc3VyZmFjZSBhcyBzeW50aCB3YXJuaW5ncyB3aXRoIGNvbnN0cnVjdCB0cmFjZXMsIHdoaWNoIGNhbiBiZSBtdXRlZCBwZXJcbiAgICogZmluZGluZyB2aWEgYEFja25vd2xlZGdlIHdpdGggJ0Nsb3VkRm9ybWF0aW9uLVZhbGlkYXRlOjo8cnVsZS1pZD4nYC5cbiAgICpcbiAgICogQGRlZmF1bHQgdHJ1ZVxuICAgKi9cbiAgcmVhZG9ubHkgZW5mb3JjZT86IGJvb2xlYW47XG5cbiAgLyoqXG4gICAqIEluIGVuZm9yY2UgbW9kZSwgYWRkaXRpb25hbGx5IGZhaWwgc3ludGhlc2lzIG9uIGVycm9yLWNsYXNzIGZpbmRpbmdzXG4gICAqIChzZXZlcml0eSBFUlJPUi9GQVRBTCkgb2YgdGhlIGJ1aWx0LWluIHZhbGlkYXRpb24gZW5naW5lIGl0c2VsZiwgZS5nLlxuICAgKiBzY2hlbWEgdmlvbGF0aW9ucyBsaWtlIGBGMzAzNGAuIFRoaXMgaXMgdGhlIHdvcmthcm91bmQgZm9yIHRoZSBDREtcbiAgICogYmVoYXZpb3Igd2hlcmUgYWxsIGJ1aWx0LWluIGZpbmRpbmdzIGFyZSBkb3duZ3JhZGVkIHRvIHdhcm5pbmdzLlxuICAgKlxuICAgKiBPbmx5IGVmZmVjdGl2ZSBpbiBlbmZvcmNlIG1vZGUgKHRoZSBkZWZhdWx0KS5cbiAgICpcbiAgICogQGRlZmF1bHQgZmFsc2VcbiAgICovXG4gIHJlYWRvbmx5IHN0cmljdD86IGJvb2xlYW47XG5cbiAgLyoqXG4gICAqIEluY2x1ZGUgcnVsZXMgdGhhdCBhcmUgbWFya2VkIGBwZW5kaW5nLWVuZ2luZWAgKGNhbmRpZGF0ZXMgdGhhdCBoYXZlIGJlZW5cbiAgICogcHJvcG9zZWQgdG8gdGhlIHVwc3RyZWFtIGNsb3VkZm9ybWF0aW9uLXZhbGlkYXRlIGVuZ2luZSBidXQgYXJlIG5vdCBtZXJnZWRcbiAgICogeWV0KS4gRGlzYWJsZSB0aGlzIGlmIHlvdSBydW4gYSBuZXdlciBlbmdpbmUgdGhhdCBhbHJlYWR5IGNvdmVycyB0aGVtLlxuICAgKlxuICAgKiBAZGVmYXVsdCB0cnVlXG4gICAqL1xuICByZWFkb25seSBpbmNsdWRlVXBzdHJlYW1QZW5kaW5nPzogYm9vbGVhbjtcbn1cblxuLyoqXG4gKiBjZGstcHJlZmxpZ2h0OiBjYXRjaCBkZXBsb3ktdGltZSBDbG91ZEZvcm1hdGlvbiBmYWlsdXJlcyBhdCBzeW50aCB0aW1lLlxuICpcbiAqIEluamVjdHMgYSBjdXJhdGVkIFJlZ28gcnVsZSBwYWNrIChjb25zdHJhaW50cyB0aGF0IHJlc291cmNlIHByb3ZpZGVyIHNjaGVtYXNcbiAqIGRvIG5vdCBleHByZXNzOiBkb2Mtb25seSB2YWx1ZSBsaW1pdHMsIGNyb3NzLXByb3BlcnR5IGFuZCBjcm9zcy1yZXNvdXJjZVxuICogcnVsZXMpIGludG8gdGhlIEFXUyBDREsgYnVpbHQtaW4gQ2xvdWRGb3JtYXRpb24gdmFsaWRhdG9yLlxuICpcbiAqIEBleGFtcGxlXG4gKiBkZWNsYXJlIGNvbnN0IGFwcDogQXBwO1xuICogUHJlZmxpZ2h0LmFwcGx5KGFwcCk7XG4gKi9cbmV4cG9ydCBjbGFzcyBQcmVmbGlnaHQge1xuICAvKipcbiAgICogUmVnaXN0ZXIgdGhlIGNkay1wcmVmbGlnaHQgcnVsZXMgb24gYW4gQXBwIG9yIFN0YWdlLlxuICAgKi9cbiAgcHVibGljIHN0YXRpYyBhcHBseShzY29wZTogSUNvbnN0cnVjdCwgb3B0aW9uczogUHJlZmxpZ2h0T3B0aW9ucyA9IHt9KTogdm9pZCB7XG4gICAgaWYgKCFTdGFnZS5pc1N0YWdlKHNjb3BlKSkge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKCdjZGstcHJlZmxpZ2h0OiBQcmVmbGlnaHQuYXBwbHkoKSBtdXN0IGJlIGNhbGxlZCBvbiBhbiBBcHAgb3IgYSBTdGFnZScpO1xuICAgIH1cbiAgICBjb25zdCBleGNsdWRlID0gb3B0aW9ucy5leGNsdWRlID8/IFtdO1xuICAgIGNvbnN0IHVua25vd24gPSBleGNsdWRlLmZpbHRlcigoaWQpID0+ICFCVU5ETEVEX1JVTEVTLnNvbWUoKHIpID0+IHIuaWQgPT09IGlkKSk7XG4gICAgaWYgKHVua25vd24ubGVuZ3RoID4gMCkge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKGBjZGstcHJlZmxpZ2h0OiB1bmtub3duIHJ1bGUgaWQocykgaW4gZXhjbHVkZTogJHt1bmtub3duLmpvaW4oJywgJyl9YCk7XG4gICAgfVxuICAgIGNvbnN0IHNlbGVjdGVkID0gQlVORExFRF9SVUxFU1xuICAgICAgLmZpbHRlcigocikgPT4gKG9wdGlvbnMuaW5jbHVkZVVwc3RyZWFtUGVuZGluZyA/PyB0cnVlKSB8fCByLnVwc3RyZWFtICE9PSAncGVuZGluZy1lbmdpbmUnKVxuICAgICAgLmZpbHRlcigocikgPT4gIWV4Y2x1ZGUuaW5jbHVkZXMoci5pZCkpO1xuXG4gICAgaWYgKG9wdGlvbnMuZW5mb3JjZSA/PyB0cnVlKSB7XG4gICAgICBWYWxpZGF0aW9ucy5vZihzY29wZSkuYWRkUGx1Z2lucyhuZXcgUHJlZmxpZ2h0RW5mb3JjZVBsdWdpbihzZWxlY3RlZCwgb3B0aW9ucy5zdHJpY3QgPz8gZmFsc2UpKTtcbiAgICAgIGluc3RhbGxFbmZvcmNlR2F0ZShzY29wZSk7XG4gICAgfSBlbHNlIHtcbiAgICAgIFZhbGlkYXRpb25zLm9mKHNjb3BlKS5hZGRQbHVnaW5zKG5ldyBDbG91ZEZvcm1hdGlvblZhbGlkYXRlUGx1Z2luKHtcbiAgICAgICAgcmVnb1J1bGVzOiBbXG4gICAgICAgICAgLi4uQlVORExFRF9MSUJTLm1hcCgobCkgPT4gKHsgbmFtZTogbC5uYW1lLCBjb250ZW50OiBsLnJlZ28gfSkpLFxuICAgICAgICAgIC4uLnNlbGVjdGVkLm1hcCgocikgPT4gKHsgbmFtZTogci5pZCwgY29udGVudDogci5yZWdvIH0pKSxcbiAgICAgICAgXSxcbiAgICAgIH0pKTtcbiAgICB9XG4gIH1cblxuICAvKipcbiAgICogVGhlIGlkcyBvZiBhbGwgYnVuZGxlZCBydWxlcy5cbiAgICovXG4gIHB1YmxpYyBzdGF0aWMgcnVsZUlkcygpOiBzdHJpbmdbXSB7XG4gICAgcmV0dXJuIEJVTkRMRURfUlVMRVMubWFwKChyKSA9PiByLmlkKTtcbiAgfVxuXG4gIHByaXZhdGUgY29uc3RydWN0b3IoKSB7fVxufVxuIl19

package/lib/private/enforce.d.ts

@@ -1,4 +1,5 @@
-import type { IPolicyValidationContext, IPolicyValidationPlugin, PolicyValidationPluginReport } from 'aws-cdk-lib';
+import { type IPolicyValidationContext, type IPolicyValidationPlugin, type PolicyValidationPluginReport } from 'aws-cdk-lib';
+import type { IConstruct } from 'constructs';
 import { type BundledRuleData } from '../rules.generated';
 /**
  * The name of the generated Rego module that carries the deployment
@@ -41,6 +42,31 @@ export declare class PreflightEnforcePlugin implements IPolicyValidationPlugin {
     constructor(rules: BundledRuleData[], strict: boolean);
     validate(context: IPolicyValidationContext): PolicyValidationPluginReport;
 }
+/** The plugin name recorded in `validation-report.json` for our findings. */
+export declare const PLUGIN_NAME = "cdk-preflight";
+/**
+ * enforce モードの取りこぼしを塞ぐゲートを App に仕込む。
+ *
+ * CDK CLI 2.1128.1 以降は app に「レポートは CLI が処理する」と伝えたうえで
+ * `validation-report.json` を自分で読むが、その絞り込み（toolkit-lib の
+ * `filterReportsByStacks`）が violation の constructPath 先頭セグメントを
+ * 選択スタックの hierarchicalId と突き合わせるため、`Stage/Stack` 形式になる
+ * Stage 内スタックの違反がすべて捨てられ、synth が黙って成功する（issue #113）。
+ *
+ * そこで synth 完了後にレポートを読み直し、cdk-preflight の違反が残っていれば
+ * 自分で報告して synth を止める。ライブラリが自力で報告する経路（素の node 実行、
+ * jest、CLI 2.1128.1 未満）では synth が例外を投げるためここには到達せず、
+ * 二重報告は起きない。
+ */
+export declare function installEnforceGate(scope: IConstruct): void;
+/**
+ * CDK 本体のフォーマッタを解決できないときの最小限の整形。
+ * 見た目は劣るが、findings を必ず読める形で出すための最後の砦。
+ * （テストからも利用するため export している）
+ */
+export declare function fallbackFormat(pluginReports: any[]): string;
+/** （テストからも利用するため export している） */
+export declare function loadFormatter(): any | undefined;
 /**
  * @aws/cloudformation-validate を解決する。
  * 通常は aws-cdk-lib が bundledDependencies として同梱しているコピーに乗る。

package/lib/private/enforce.js

@@ -33,12 +33,17 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PreflightEnforcePlugin = exports.DEPLOY_ENV_MODULE_NAME = void 0;
+exports.PLUGIN_NAME = exports.PreflightEnforcePlugin = exports.DEPLOY_ENV_MODULE_NAME = void 0;
 exports.deployEnvironmentModule = deployEnvironmentModule;
 exports.isConcreteAccount = isConcreteAccount;
 exports.isConcreteRegion = isConcreteRegion;
+exports.installEnforceGate = installEnforceGate;
+exports.fallbackFormat = fallbackFormat;
+exports.loadFormatter = loadFormatter;
 exports.loadEngine = loadEngine;
+const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
+const aws_cdk_lib_1 = require("aws-cdk-lib");
 const rules_generated_1 = require("../rules.generated");
 /* eslint-disable @typescript-eslint/no-require-imports */
 /* eslint-disable import/no-extraneous-dependencies -- @aws/cloudformation-validate は
@@ -87,7 +92,7 @@ function isConcreteRegion(region) {
 class PreflightEnforcePlugin {
     rules;
     strict;
-    name = 'cdk-preflight';
+    name = exports.PLUGIN_NAME;
     constructor(rules, strict) {
         this.rules = rules;
         this.strict = strict;
@@ -137,6 +142,129 @@ class PreflightEnforcePlugin {
     }
 }
 exports.PreflightEnforcePlugin = PreflightEnforcePlugin;
+/** The plugin name recorded in `validation-report.json` for our findings. */
+exports.PLUGIN_NAME = 'cdk-preflight';
+/** The cloud assembly file the CDK writes its validation report to. */
+const VALIDATION_REPORT_FILE = 'validation-report.json';
+const GATE_INSTALLED = Symbol.for('cdk-preflight.enforceGate');
+/**
+ * enforce モードの取りこぼしを塞ぐゲートを App に仕込む。
+ *
+ * CDK CLI 2.1128.1 以降は app に「レポートは CLI が処理する」と伝えたうえで
+ * `validation-report.json` を自分で読むが、その絞り込み（toolkit-lib の
+ * `filterReportsByStacks`）が violation の constructPath 先頭セグメントを
+ * 選択スタックの hierarchicalId と突き合わせるため、`Stage/Stack` 形式になる
+ * Stage 内スタックの違反がすべて捨てられ、synth が黙って成功する（issue #113）。
+ *
+ * そこで synth 完了後にレポートを読み直し、cdk-preflight の違反が残っていれば
+ * 自分で報告して synth を止める。ライブラリが自力で報告する経路（素の node 実行、
+ * jest、CLI 2.1128.1 未満）では synth が例外を投げるためここには到達せず、
+ * 二重報告は起きない。
+ */
+function installEnforceGate(scope) {
+    const root = scope.node.root;
+    if (!aws_cdk_lib_1.App.isApp(root))
+        return;
+    const app = root;
+    if (app[GATE_INSTALLED])
+        return;
+    Object.defineProperty(app, GATE_INSTALLED, { value: true, enumerable: false });
+    const synth = app.synth.bind(app);
+    let checked = false;
+    app.synth = (options) => {
+        const assembly = synth(options);
+        if (!checked) {
+            checked = true;
+            failIfReportUnhandled(assembly.directory);
+        }
+        return assembly;
+    };
+}
+/**
+ * レポートに cdk-preflight の失敗が残っていれば、findings を出力して synth を止める。
+ *
+ * 判定は cdk-preflight のレポートだけを見る。組み込みエンジンや construct annotation
+ * だけが失敗している場合は CLI が正しく扱えるので、こちらは黙って CLI に任せる。
+ * 逆に発火するときはレポート全体を出す。ここで synth を止めると CLI 側の出力が
+ * 一切走らないため、同時に出ていたはずの他プラグインの finding が消えてしまう。
+ */
+function failIfReportUnhandled(directory) {
+    let pluginReports;
+    try {
+        const report = JSON.parse(fs.readFileSync(path.join(directory, VALIDATION_REPORT_FILE), 'utf8'));
+        pluginReports = report?.pluginReports ?? [];
+    }
+    catch {
+        // レポートが無い（プラグイン未実行）または壊れている場合は何もしない
+        return;
+    }
+    const failed = pluginReports.some((r) => r?.pluginName === exports.PLUGIN_NAME && r?.conclusion === 'failure');
+    if (!failed)
+        return;
+    // eslint-disable-next-line no-console
+    console.error(formatReports(pluginReports));
+    throw new Error('cdk-preflight: validation failed. Fix the findings above, ' +
+        "acknowledge them with Validations.of(scope).acknowledge({ id: 'cdk-preflight::<rule-id>' }), " +
+        'or exclude the rule via Preflight.apply(app, { exclude: [...] }).');
+}
+/**
+ * CDK 本体のフォーマッタで整形し、CLI と同一の見た目にする。
+ * 私有パスなので解決できないことがあり、その場合は最小限の自前整形に落とす
+ * （見た目より「落とす」ことを優先する）。
+ */
+function formatReports(pluginReports) {
+    const formatter = loadFormatterCached();
+    if (formatter) {
+        try {
+            return formatter.formatValidationReports(process.cwd(), pluginReports).join('\n\n');
+        }
+        catch {
+            // fall through
+        }
+    }
+    return fallbackFormat(pluginReports);
+}
+/**
+ * CDK 本体のフォーマッタを解決できないときの最小限の整形。
+ * 見た目は劣るが、findings を必ず読める形で出すための最後の砦。
+ * （テストからも利用するため export している）
+ */
+function fallbackFormat(pluginReports) {
+    const blocks = [];
+    for (const report of pluginReports) {
+        for (const violation of report?.violations ?? []) {
+            const ackId = String(violation.ruleName).includes('::')
+                ? violation.ruleName
+                : `${report.pluginName}::${violation.ruleName}`;
+            for (const c of violation.violatingConstructs ?? []) {
+                blocks.push(`${String(violation.severity ?? 'ERROR').toUpperCase()} ${violation.description} (${report.pluginName})\n` +
+                    `   ${c.constructPath} (${c.cloudFormationResource?.logicalId}) ${c.constructFqn}\n` +
+                    `   Acknowledge with '${String(ackId).replace(/ /g, '-')}'`);
+            }
+        }
+    }
+    return blocks.join('\n\n');
+}
+// フォーマッタは aws-cdk-lib の私有パスにあり `exports` から見えないため、
+// エンジン解決（loadEngine）と同じくパッケージルートからの絶対パスで読み込む。
+let cachedFormatter;
+function loadFormatterCached() {
+    if (cachedFormatter === undefined) {
+        cachedFormatter = loadFormatter() ?? false;
+    }
+    return cachedFormatter === false ? undefined : cachedFormatter;
+}
+/** （テストからも利用するため export している） */
+function loadFormatter() {
+    try {
+        const libRoot = path.dirname(require.resolve('aws-cdk-lib/package.json'));
+        const mod = require(path.join(libRoot, 'core/lib/validation/private/modern-formatter.js'));
+        return typeof mod?.formatValidationReports === 'function' ? mod : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 // エンジン（WASM）の初期化は重いため、モジュールレベルでキャッシュする
 let cachedEngineModule;
 function loadEngineCached() {
@@ -183,4 +311,4 @@ function loadEngine() {
         return undefined;
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZW5mb3JjZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9wcml2YXRlL2VuZm9yY2UudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0FBNkJBLDBEQU1DO0FBR0QsOENBRUM7QUFNRCw0Q0FFQztBQTJHRCxnQ0FlQztBQTFLRCwyQ0FBNkI7QUFPN0Isd0RBQXdFO0FBRXhFLDBEQUEwRDtBQUMxRDs4REFDOEQ7QUFFOUQ7OztHQUdHO0FBQ1UsUUFBQSxzQkFBc0IsR0FBRyx3QkFBd0IsQ0FBQztBQUUvRDs7Ozs7Ozs7O0dBU0c7QUFDSCxTQUFnQix1QkFBdUIsQ0FBQyxNQUFjLEVBQUUsU0FBa0I7SUFDeEUsTUFBTSxPQUFPLEdBQUcsaUJBQWlCLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxDQUFDLHFCQUFxQixJQUFJLENBQUMsU0FBUyxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztJQUN2RyxPQUFPO1FBQ0wsSUFBSSxFQUFFLDhCQUFzQjtRQUM1QixPQUFPLEVBQUUsK0RBQStELElBQUksQ0FBQyxTQUFTLENBQUMsTUFBTSxDQUFDLEtBQUssT0FBTyxFQUFFO0tBQzdHLENBQUM7QUFDSixDQUFDO0FBRUQseUZBQXlGO0FBQ3pGLFNBQWdCLGlCQUFpQixDQUFDLFNBQTZCO0lBQzdELE9BQU8sT0FBTyxTQUFTLEtBQUssUUFBUSxJQUFJLFVBQVUsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUM7QUFDckUsQ0FBQztBQUVEOzs7R0FHRztBQUNILFNBQWdCLGdCQUFnQixDQUFDLE1BQTBCO0lBQ3pELE9BQU8sT0FBTyxNQUFNLEtBQUssUUFBUSxJQUFJLDBCQUEwQixDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQztBQUMvRSxDQUFDO0FBWUQ7Ozs7Ozs7R0FPRztBQUNILE1BQWEsc0JBQXNCO0lBSWQ7SUFDQTtJQUpILElBQUksR0FBRyxlQUFlLENBQUM7SUFFdkMsWUFDbUIsS0FBd0IsRUFDeEIsTUFBZTtRQURmLFVBQUssR0FBTCxLQUFLLENBQW1CO1FBQ3hCLFdBQU0sR0FBTixNQUFNLENBQVM7SUFDL0IsQ0FBQztJQUVHLFFBQVEsQ0FBQyxPQUFpQztRQUMvQyxNQUFNLE1BQU0sR0FBRyxnQkFBZ0IsRUFBRSxDQUFDO1FBQ2xDLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUNaLHNDQUFzQztZQUN0QyxPQUFPLENBQUMsS0FBSyxDQUNYLGlFQUFpRTtnQkFDakUsZ0VBQWdFO2dCQUNoRSwrREFBK0QsQ0FDaEUsQ0FBQztZQUNGLE9BQU8sRUFBRSxPQUFPLEVBQUUsSUFBSSxFQUFFLFVBQVUsRUFBRSxFQUFFLEVBQUUsQ0FBQztRQUMzQyxDQUFDO1FBRUQsTUFBTSxNQUFNLEdBQUcsZ0JBQWdCLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7UUFDN0UsTUFBTSxPQUFPLEdBQUcsaUJBQWlCLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7UUFDckYsTUFBTSxHQUFHLEdBQUcsZ0JBQWdCLENBQUMsTUFBTSxFQUFFLElBQUksQ0FBQyxLQUFLLEVBQUUsTUFBTSxFQUFFLE9BQU8sQ0FBQyxDQUFDO1FBQ2xFLE1BQU0sSUFBSSxHQUFHLElBQUksR0FBRyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQztRQUNsRCxNQUFNLFVBQVUsR0FBc0IsRUFBRSxDQUFDO1FBRXpDLEtBQUssTUFBTSxFQUFFLElBQUksT0FBTyxDQUFDLGNBQWMsRUFBRSxDQUFDO1lBQ3hDLE1BQU0sTUFBTSxHQUFHLEdBQUcsQ0FBQyxnQkFBZ0IsQ0FBQyxJQUFJLE1BQU0sQ0FBQyxZQUFZLENBQUMsRUFBRSxDQUFDLFlBQVksQ0FBQyxFQUFFO2dCQUM1RSx3QkFBd0IsRUFBRTtvQkFDeEIsU0FBUyxFQUFFLE9BQU8sQ0FBQyxTQUFTO29CQUM1QixNQUFNLEVBQUUsT0FBTyxDQUFDLE1BQU07aUJBQ3ZCO2FBQ0YsQ0FBQyxDQUFDO1lBQ0gsS0FBSyxNQUFNLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLElBQUksRUFBRSxDQUF1QixFQUFFLENBQUM7Z0JBQ2pFLE1BQU0sTUFBTSxHQUFHLENBQUMsQ0FBQyxNQUFNLEtBQUssUUFBUSxJQUFJLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxDQUFDO2dCQUMzRCxNQUFNLFdBQVcsR0FBRyxJQUFJLENBQUMsTUFBTTt1QkFDMUIsQ0FBQyxDQUFDLE1BQU0sS0FBSyxRQUFRO3VCQUNyQixDQUFDLENBQUMsQ0FBQyxRQUFRLEtBQUssT0FBTyxJQUFJLENBQUMsQ0FBQyxRQUFRLEtBQUssT0FBTyxDQUFDLENBQUM7Z0JBQ3hELElBQUksQ0FBQyxNQUFNLElBQUksQ0FBQyxXQUFXO29CQUFFLFNBQVM7Z0JBQ3RDLFVBQVUsQ0FBQyxJQUFJLENBQUM7b0JBQ2QsUUFBUSxFQUFFLENBQUMsQ0FBQyxNQUFNO29CQUNsQixXQUFXLEVBQUUsQ0FBQyxDQUFDLE9BQU87b0JBQ3RCLFFBQVEsRUFBRSxPQUFPO29CQUNqQixrQkFBa0IsRUFBRSxDQUFDOzRCQUNuQixpQkFBaUIsRUFBRSxDQUFDLENBQUMsTUFBTSxFQUFFLFNBQVMsSUFBSSxXQUFXOzRCQUNyRCxZQUFZLEVBQUUsRUFBRSxDQUFDLFlBQVk7NEJBQzdCLFNBQVMsRUFBRSxDQUFDLENBQUMsQ0FBQyxZQUFZLElBQUksWUFBWSxDQUFDO3lCQUM1QyxDQUFDO29CQUNGLEdBQUcsQ0FBQyxDQUFDLENBQUMsZ0JBQWdCLENBQUMsQ0FBQyxDQUFDLEVBQUUsWUFBWSxFQUFFLEVBQUUsZ0JBQWdCLEVBQUUsQ0FBQyxDQUFDLGdCQUFnQixFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO2lCQUMxRixDQUFDLENBQUM7WUFDTCxDQUFDO1FBQ0gsQ0FBQztRQUVELE9BQU8sRUFBRSxPQUFPLEVBQUUsVUFBVSxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsVUFBVSxFQUFFLENBQUM7SUFDMUQsQ0FBQztDQUNGO0FBdkRELHdEQXVEQztBQUVELHVDQUF1QztBQUN2QyxJQUFJLGtCQUEyQyxDQUFDO0FBQ2hELFNBQVMsZ0JBQWdCO0lBQ3ZCLElBQUksa0JBQWtCLEtBQUssU0FBUyxFQUFFLENBQUM7UUFDckMsa0JBQWtCLEdBQUcsVUFBVSxFQUFFLElBQUksS0FBSyxDQUFDO0lBQzdDLENBQUM7SUFDRCxPQUFPLGtCQUFrQixLQUFLLEtBQUssQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxrQkFBa0IsQ0FBQztBQUN2RSxDQUFDO0FBRUQsTUFBTSxlQUFlLEdBQUcsSUFBSSxHQUFHLEVBQWUsQ0FBQztBQUMvQyxTQUFTLGdCQUFnQixDQUFDLFlBQWlCLEVBQUUsS0FBd0IsRUFBRSxNQUFlLEVBQUUsT0FBZ0I7SUFDdEcsTUFBTSxHQUFHLEdBQUcsR0FBRyxNQUFNLElBQUksRUFBRSxJQUFJLE9BQU8sSUFBSSxFQUFFLElBQUksS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO0lBQ25GLElBQUksQ0FBQyxlQUFlLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDOUIsTUFBTSxXQUFXLEdBQUc7WUFDbEIsR0FBRyw4QkFBWSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxFQUFFLElBQUksRUFBRSxDQUFDLENBQUMsSUFBSSxFQUFFLE9BQU8sRUFBRSxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQztZQUMvRCxHQUFHLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDLEVBQUUsRUFBRSxPQUFPLEVBQUUsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDLENBQUM7U0FDdkQsQ0FBQztRQUNGLElBQUksTUFBTSxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQ3pCLFdBQVcsQ0FBQyxJQUFJLENBQUMsdUJBQXVCLENBQUMsTUFBTSxFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQUM7UUFDN0QsQ0FBQztRQUNELGVBQWUsQ0FBQyxHQUFHLENBQUMsR0FBRyxFQUFFLElBQUksWUFBWSxDQUFDLFVBQVUsQ0FBQyxFQUFFLFdBQVcsRUFBRSxDQUFDLENBQUMsQ0FBQztJQUN6RSxDQUFDO0lBQ0QsT0FBTyxlQUFlLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFDO0FBQ2xDLENBQUM7QUFFRDs7OztHQUlHO0FBQ0gsU0FBZ0IsVUFBVTtJQUN4QixJQUFJLENBQUM7UUFDSCxPQUFPLE9BQU8sQ0FBQyw4QkFBOEIsQ0FBQyxDQUFDO0lBQ2pELENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxlQUFlO0lBQ2pCLENBQUM7SUFDRCxJQUFJLENBQUM7UUFDSCxNQUFNLE1BQU0sR0FBRyxPQUFPLENBQUMsT0FBTyxDQUFDLDBCQUEwQixDQUFDLENBQUM7UUFDM0QsTUFBTSxNQUFNLEdBQUcsT0FBTyxDQUFDLE9BQU8sQ0FBQywyQ0FBMkMsRUFBRTtZQUMxRSxLQUFLLEVBQUUsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQUFDO1NBQzlCLENBQUMsQ0FBQztRQUNILE9BQU8sT0FBTyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztJQUN2QyxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ1AsT0FBTyxTQUFTLENBQUM7SUFDbkIsQ0FBQztBQUNILENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgKiBhcyBwYXRoIGZyb20gJ3BhdGgnO1xuaW1wb3J0IHR5cGUge1xuICBJUG9saWN5VmFsaWRhdGlvbkNvbnRleHQsXG4gIElQb2xpY3lWYWxpZGF0aW9uUGx1Z2luLFxuICBQb2xpY3lWYWxpZGF0aW9uUGx1Z2luUmVwb3J0LFxuICBQb2xpY3lWaW9sYXRpb24sXG59IGZyb20gJ2F3cy1jZGstbGliJztcbmltcG9ydCB7IEJVTkRMRURfTElCUywgdHlwZSBCdW5kbGVkUnVsZURhdGEgfSBmcm9tICcuLi9ydWxlcy5nZW5lcmF0ZWQnO1xuXG4vKiBlc2xpbnQtZGlzYWJsZSBAdHlwZXNjcmlwdC1lc2xpbnQvbm8tcmVxdWlyZS1pbXBvcnRzICovXG4vKiBlc2xpbnQtZGlzYWJsZSBpbXBvcnQvbm8tZXh0cmFuZW91cy1kZXBlbmRlbmNpZXMgLS0gQGF3cy9jbG91ZGZvcm1hdGlvbi12YWxpZGF0ZSDjga9cbiAgIGF3cy1jZGstbGliIOWQjOaiseOCs+ODlOODvOOCkuWLleeahOino+axuuOBmeOCi+ioreioiO+8iOS+neWtmOOBq+OBr+i8ieOBm+OBquOBhO+8ieOAglJFQURNRS9BR0VOVFMubWQg5Y+C54WnICovXG5cbi8qKlxuICogVGhlIG5hbWUgb2YgdGhlIGdlbmVyYXRlZCBSZWdvIG1vZHVsZSB0aGF0IGNhcnJpZXMgdGhlIGRlcGxveW1lbnRcbiAqIGVudmlyb25tZW50IGludG8gcnVsZSBldmFsdWF0aW9uLlxuICovXG5leHBvcnQgY29uc3QgREVQTE9ZX0VOVl9NT0RVTEVfTkFNRSA9ICdfcGZfZGVwbG95X2Vudmlyb25tZW50JztcblxuLyoqXG4gKiBCdWlsZCB0aGUgZ2VuZXJhdGVkIG1vZHVsZSBkZWZpbmluZyBgZGVwbG95X3JlZ2lvbmAgZm9yIHRoZSBydWxlIHBhY2thZ2UuXG4gKlxuICogUnVsZXMgbXVzdCByZWFkIGl0IGFzIGBkYXRhLmNka19wcmVmbGlnaHQuZGVwbG95X3JlZ2lvbmAgKG5ldmVyIGFzIGEgYmFyZVxuICogdmFyaWFibGUpOiB0aGUgZGF0YSByZWZlcmVuY2UgaXMgc2ltcGx5IHVuZGVmaW5lZCB3aGVuIHRoZSBtb2R1bGUgaXMgbm90XG4gKiBpbmplY3RlZCDigJQgdGhlIHJ1bGUgYm9keSBmYWlscyBhbmQgdGhlIHJ1bGUgc2tpcHMg4oCUIHdoaWxlIGEgYmFyZSB2YXJpYWJsZVxuICogd291bGQgYmUgYSBjb21waWxlIGVycm9yLiBJbmplY3RlZCBieSB0aGUgZW5mb3JjZSBwbHVnaW4gd2hlbiB0aGUgYXBwLWxldmVsXG4gKiByZWdpb24gaXMgY29uY3JldGU7IHRoZSB3YXJuIG1vZGUgKENESyBidWlsdC1pbiBwbHVnaW4pIG5ldmVyIGluamVjdHMgaXQsXG4gKiBzbyByZWdpb24tZGVwZW5kZW50IHJ1bGVzIG9ubHkgZmlyZSBpbiBlbmZvcmNlIG1vZGUuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBkZXBsb3lFbnZpcm9ubWVudE1vZHVsZShyZWdpb246IHN0cmluZywgYWNjb3VudElkPzogc3RyaW5nKTogeyBuYW1lOiBzdHJpbmc7IGNvbnRlbnQ6IHN0cmluZyB9IHtcbiAgY29uc3QgYWNjb3VudCA9IGlzQ29uY3JldGVBY2NvdW50KGFjY291bnRJZCkgPyBgZGVwbG95X2FjY291bnQgOj0gJHtKU09OLnN0cmluZ2lmeShhY2NvdW50SWQpfVxcbmAgOiAnJztcbiAgcmV0dXJuIHtcbiAgICBuYW1lOiBERVBMT1lfRU5WX01PRFVMRV9OQU1FLFxuICAgIGNvbnRlbnQ6IGBwYWNrYWdlIGNka19wcmVmbGlnaHRcXG5cXG5pbXBvcnQgcmVnby52MVxcblxcbmRlcGxveV9yZWdpb24gOj0gJHtKU09OLnN0cmluZ2lmeShyZWdpb24pfVxcbiR7YWNjb3VudH1gLFxuICB9O1xufVxuXG4vKiogV2hldGhlciB0aGUgYWNjb3VudCBmcm9tIHRoZSB2YWxpZGF0aW9uIGNvbnRleHQgaXMgYSBjb25jcmV0ZSAxMi1kaWdpdCBhY2NvdW50IGlkLiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGlzQ29uY3JldGVBY2NvdW50KGFjY291bnRJZDogc3RyaW5nIHwgdW5kZWZpbmVkKTogYWNjb3VudElkIGlzIHN0cmluZyB7XG4gIHJldHVybiB0eXBlb2YgYWNjb3VudElkID09PSAnc3RyaW5nJyAmJiAvXlxcZHsxMn0kLy50ZXN0KGFjY291bnRJZCk7XG59XG5cbi8qKlxuICogV2hldGhlciB0aGUgcmVnaW9uIGZyb20gdGhlIHZhbGlkYXRpb24gY29udGV4dCBpcyBhIGNvbmNyZXRlIHJlZ2lvbiBuYW1lXG4gKiAoYXMgb3Bwb3NlZCB0byB1bmRlZmluZWQsIGFuIHVucmVzb2x2ZWQgdG9rZW4sIG9yIGEgcGxhY2Vob2xkZXIpLlxuICovXG5leHBvcnQgZnVuY3Rpb24gaXNDb25jcmV0ZVJlZ2lvbihyZWdpb246IHN0cmluZyB8IHVuZGVmaW5lZCk6IHJlZ2lvbiBpcyBzdHJpbmcge1xuICByZXR1cm4gdHlwZW9mIHJlZ2lvbiA9PT0gJ3N0cmluZycgJiYgL15bYS16XXsyfSgtW2Etel0rKSstXFxkKyQvLnRlc3QocmVnaW9uKTtcbn1cblxuaW50ZXJmYWNlIEVuZ2luZURpYWdub3N0aWMge1xuICByZWFkb25seSBydWxlSWQ6IHN0cmluZztcbiAgcmVhZG9ubHkgc2V2ZXJpdHk6IHN0cmluZztcbiAgcmVhZG9ubHkgbWVzc2FnZTogc3RyaW5nO1xuICByZWFkb25seSBzb3VyY2U/OiBzdHJpbmc7XG4gIHJlYWRvbmx5IGVudGl0eT86IHsgcmVhZG9ubHkgbG9naWNhbElkPzogc3RyaW5nIH07XG4gIHJlYWRvbmx5IHByb3BlcnR5UGF0aD86IHN0cmluZztcbiAgcmVhZG9ubHkgZG9jdW1lbnRhdGlvblVybD86IHN0cmluZztcbn1cblxuLyoqXG4gKiBlbmZvcmNlIOODouODvOODieeUqOOBruWGhemDqOODl+ODqeOCsOOCpOODs+OAglxuICpcbiAqIENESyDntYTjgb/ovrzjgb/jga4gQ2xvdWRGb3JtYXRpb25WYWxpZGF0ZVBsdWdpbiDjga/lhaggZmluZGluZyDjgpIgd2FybmluZyDjgavkuLjjgoHjgovjgZ/jgoFcbiAqIO+8iGF3cy1jZGstbGliIDIuMjY3LjAg5a6f5ris44CB5piH5qC844OV44Op44Kw44KC54Sh5Yq577yJ44CB5ZCM44GY44Ko44Oz44K444Oz44KS55u05o6l5ZG844Gz44CBXG4gKiBjZGstcHJlZmxpZ2h0IOOBruODq+ODvOODq+mBleWPje+8iOOBiuOCiOOBsyBzdHJpY3Qg5pmC44Gv44Ko44Oz44K444Oz44Gu44Ko44Op44O844Kv44Op44K577yJ44KSXG4gKiBwb2xpY3kgdmFsaWRhdGlvbiDjga7lpLHmlZfjgajjgZfjgabloLHlkYrjgZfjgaYgc3ludGgg44KS5q2i44KB44KL44CCXG4gKi9cbmV4cG9ydCBjbGFzcyBQcmVmbGlnaHRFbmZvcmNlUGx1Z2luIGltcGxlbWVudHMgSVBvbGljeVZhbGlkYXRpb25QbHVnaW4ge1xuICBwdWJsaWMgcmVhZG9ubHkgbmFtZSA9ICdjZGstcHJlZmxpZ2h0JztcblxuICBjb25zdHJ1Y3RvcihcbiAgICBwcml2YXRlIHJlYWRvbmx5IHJ1bGVzOiBCdW5kbGVkUnVsZURhdGFbXSxcbiAgICBwcml2YXRlIHJlYWRvbmx5IHN0cmljdDogYm9vbGVhbixcbiAgKSB7fVxuXG4gIHB1YmxpYyB2YWxpZGF0ZShjb250ZXh0OiBJUG9saWN5VmFsaWRhdGlvbkNvbnRleHQpOiBQb2xpY3lWYWxpZGF0aW9uUGx1Z2luUmVwb3J0IHtcbiAgICBjb25zdCBlbmdpbmUgPSBsb2FkRW5naW5lQ2FjaGVkKCk7XG4gICAgaWYgKCFlbmdpbmUpIHtcbiAgICAgIC8vIGVzbGludC1kaXNhYmxlLW5leHQtbGluZSBuby1jb25zb2xlXG4gICAgICBjb25zb2xlLmVycm9yKFxuICAgICAgICAnY2RrLXByZWZsaWdodDogY291bGQgbm90IHJlc29sdmUgQGF3cy9jbG91ZGZvcm1hdGlvbi12YWxpZGF0ZTsgJyArXG4gICAgICAgICdlbmZvcmNlIG1vZGUgaXMgdW5hdmFpbGFibGUgYW5kIG5vIHByZWZsaWdodCBjaGVja3Mgd2VyZSBydW4uICcgK1xuICAgICAgICAnSW5zdGFsbCBpdCBhcyBhIGRldkRlcGVuZGVuY3kgb3IgdXNlIHRoZSBkZWZhdWx0ICh3YXJuKSBtb2RlLicsXG4gICAgICApO1xuICAgICAgcmV0dXJuIHsgc3VjY2VzczogdHJ1ZSwgdmlvbGF0aW9uczogW10gfTtcbiAgICB9XG5cbiAgICBjb25zdCByZWdpb24gPSBpc0NvbmNyZXRlUmVnaW9uKGNvbnRleHQucmVnaW9uKSA/IGNvbnRleHQucmVnaW9uIDogdW5kZWZpbmVkO1xuICAgIGNvbnN0IGFjY291bnQgPSBpc0NvbmNyZXRlQWNjb3VudChjb250ZXh0LmFjY291bnRJZCkgPyBjb250ZXh0LmFjY291bnRJZCA6IHVuZGVmaW5lZDtcbiAgICBjb25zdCBlbmcgPSByZWdvRW5naW5lQ2FjaGVkKGVuZ2luZSwgdGhpcy5ydWxlcywgcmVnaW9uLCBhY2NvdW50KTtcbiAgICBjb25zdCBvdXJzID0gbmV3IFNldCh0aGlzLnJ1bGVzLm1hcCgocikgPT4gci5pZCkpO1xuICAgIGNvbnN0IHZpb2xhdGlvbnM6IFBvbGljeVZpb2xhdGlvbltdID0gW107XG5cbiAgICBmb3IgKGNvbnN0IHN0IG9mIGNvbnRleHQuc3RhY2tUZW1wbGF0ZXMpIHtcbiAgICAgIGNvbnN0IHJlcG9ydCA9IGVuZy52YWxpZGF0ZURldGFpbGVkKG5ldyBlbmdpbmUuVGVtcGxhdGVGaWxlKHN0LnRlbXBsYXRlUGF0aCksIHtcbiAgICAgICAgcHNldWRvUGFyYW1ldGVyT3ZlcnJpZGVzOiB7XG4gICAgICAgICAgYWNjb3VudElkOiBjb250ZXh0LmFjY291bnRJZCxcbiAgICAgICAgICByZWdpb246IGNvbnRleHQucmVnaW9uLFxuICAgICAgICB9LFxuICAgICAgfSk7XG4gICAgICBmb3IgKGNvbnN0IGQgb2YgKHJlcG9ydC5kaWFnbm9zdGljcyA/PyBbXSkgYXMgRW5naW5lRGlhZ25vc3RpY1tdKSB7XG4gICAgICAgIGNvbnN0IGlzT3VycyA9IGQuc291cmNlID09PSAnQ1VTVE9NJyAmJiBvdXJzLmhhcyhkLnJ1bGVJZCk7XG4gICAgICAgIGNvbnN0IGlzU3RyaWN0SGl0ID0gdGhpcy5zdHJpY3RcbiAgICAgICAgICAmJiBkLnNvdXJjZSAhPT0gJ0NVU1RPTSdcbiAgICAgICAgICAmJiAoZC5zZXZlcml0eSA9PT0gJ0VSUk9SJyB8fCBkLnNldmVyaXR5ID09PSAnRkFUQUwnKTtcbiAgICAgICAgaWYgKCFpc091cnMgJiYgIWlzU3RyaWN0SGl0KSBjb250aW51ZTtcbiAgICAgICAgdmlvbGF0aW9ucy5wdXNoKHtcbiAgICAgICAgICBydWxlTmFtZTogZC5ydWxlSWQsXG4gICAgICAgICAgZGVzY3JpcHRpb246IGQubWVzc2FnZSxcbiAgICAgICAgICBzZXZlcml0eTogJ2Vycm9yJyxcbiAgICAgICAgICB2aW9sYXRpbmdSZXNvdXJjZXM6IFt7XG4gICAgICAgICAgICByZXNvdXJjZUxvZ2ljYWxJZDogZC5lbnRpdHk/LmxvZ2ljYWxJZCA/PyAnKHVua25vd24pJyxcbiAgICAgICAgICAgIHRlbXBsYXRlUGF0aDogc3QudGVtcGxhdGVQYXRoLFxuICAgICAgICAgICAgbG9jYXRpb25zOiBbZC5wcm9wZXJ0eVBhdGggPz8gJyh0ZW1wbGF0ZSknXSxcbiAgICAgICAgICB9XSxcbiAgICAgICAgICAuLi4oZC5kb2N1bWVudGF0aW9uVXJsID8geyBydWxlTWV0YWRhdGE6IHsgRG9jdW1lbnRhdGlvblVybDogZC5kb2N1bWVudGF0aW9uVXJsIH0gfSA6IHt9KSxcbiAgICAgICAgfSk7XG4gICAgICB9XG4gICAgfVxuXG4gICAgcmV0dXJuIHsgc3VjY2VzczogdmlvbGF0aW9ucy5sZW5ndGggPT09IDAsIHZpb2xhdGlvbnMgfTtcbiAgfVxufVxuXG4vLyDjgqjjg7Pjgrjjg7PvvIhXQVNN77yJ44Gu5Yid5pyf5YyW44Gv6YeN44GE44Gf44KB44CB44Oi44K444Ol44O844Or44Os44OZ44Or44Gn44Kt44Oj44OD44K344Ol44GZ44KLXG5sZXQgY2FjaGVkRW5naW5lTW9kdWxlOiBhbnkgfCBmYWxzZSB8IHVuZGVmaW5lZDtcbmZ1bmN0aW9uIGxvYWRFbmdpbmVDYWNoZWQoKTogYW55IHwgdW5kZWZpbmVkIHtcbiAgaWYgKGNhY2hlZEVuZ2luZU1vZHVsZSA9PT0gdW5kZWZpbmVkKSB7XG4gICAgY2FjaGVkRW5naW5lTW9kdWxlID0gbG9hZEVuZ2luZSgpID8/IGZhbHNlO1xuICB9XG4gIHJldHVybiBjYWNoZWRFbmdpbmVNb2R1bGUgPT09IGZhbHNlID8gdW5kZWZpbmVkIDogY2FjaGVkRW5naW5lTW9kdWxlO1xufVxuXG5jb25zdCByZWdvRW5naW5lQ2FjaGUgPSBuZXcgTWFwPHN0cmluZywgYW55PigpO1xuZnVuY3Rpb24gcmVnb0VuZ2luZUNhY2hlZChlbmdpbmVNb2R1bGU6IGFueSwgcnVsZXM6IEJ1bmRsZWRSdWxlRGF0YVtdLCByZWdpb24/OiBzdHJpbmcsIGFjY291bnQ/OiBzdHJpbmcpOiBhbnkge1xuICBjb25zdCBrZXkgPSBgJHtyZWdpb24gPz8gJyd9fCR7YWNjb3VudCA/PyAnJ318JHtydWxlcy5tYXAoKHIpID0+IHIuaWQpLmpvaW4oJywnKX1gO1xuICBpZiAoIXJlZ29FbmdpbmVDYWNoZS5oYXMoa2V5KSkge1xuICAgIGNvbnN0IGN1c3RvbVJ1bGVzID0gW1xuICAgICAgLi4uQlVORExFRF9MSUJTLm1hcCgobCkgPT4gKHsgbmFtZTogbC5uYW1lLCBjb250ZW50OiBsLnJlZ28gfSkpLFxuICAgICAgLi4ucnVsZXMubWFwKChyKSA9PiAoeyBuYW1lOiByLmlkLCBjb250ZW50OiByLnJlZ28gfSkpLFxuICAgIF07XG4gICAgaWYgKHJlZ2lvbiAhPT0gdW5kZWZpbmVkKSB7XG4gICAgICBjdXN0b21SdWxlcy5wdXNoKGRlcGxveUVudmlyb25tZW50TW9kdWxlKHJlZ2lvbiwgYWNjb3VudCkpO1xuICAgIH1cbiAgICByZWdvRW5naW5lQ2FjaGUuc2V0KGtleSwgbmV3IGVuZ2luZU1vZHVsZS5SZWdvRW5naW5lKHsgY3VzdG9tUnVsZXMgfSkpO1xuICB9XG4gIHJldHVybiByZWdvRW5naW5lQ2FjaGUuZ2V0KGtleSk7XG59XG5cbi8qKlxuICogQGF3cy9jbG91ZGZvcm1hdGlvbi12YWxpZGF0ZSDjgpLop6PmsbrjgZnjgovjgIJcbiAqIOmAmuW4uOOBryBhd3MtY2RrLWxpYiDjgYwgYnVuZGxlZERlcGVuZGVuY2llcyDjgajjgZfjgablkIzmorHjgZfjgabjgYTjgovjgrPjg5Tjg7zjgavkuZfjgovjgIJcbiAqIO+8iOODhuOCueODiOOBi+OCieOCguWIqeeUqOOBmeOCi+OBn+OCgSBleHBvcnQg44GX44Gm44GE44KL77yJXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBsb2FkRW5naW5lKCk6IGFueSB8IHVuZGVmaW5lZCB7XG4gIHRyeSB7XG4gICAgcmV0dXJuIHJlcXVpcmUoJ0Bhd3MvY2xvdWRmb3JtYXRpb24tdmFsaWRhdGUnKTtcbiAgfSBjYXRjaCB7XG4gICAgLy8gZmFsbCB0aHJvdWdoXG4gIH1cbiAgdHJ5IHtcbiAgICBjb25zdCBsaWJQa2cgPSByZXF1aXJlLnJlc29sdmUoJ2F3cy1jZGstbGliL3BhY2thZ2UuanNvbicpO1xuICAgIGNvbnN0IGVuZ1BrZyA9IHJlcXVpcmUucmVzb2x2ZSgnQGF3cy9jbG91ZGZvcm1hdGlvbi12YWxpZGF0ZS9wYWNrYWdlLmpzb24nLCB7XG4gICAgICBwYXRoczogW3BhdGguZGlybmFtZShsaWJQa2cpXSxcbiAgICB9KTtcbiAgICByZXR1cm4gcmVxdWlyZShwYXRoLmRpcm5hbWUoZW5nUGtnKSk7XG4gIH0gY2F0Y2gge1xuICAgIHJldHVybiB1bmRlZmluZWQ7XG4gIH1cbn1cbiJdfQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZW5mb3JjZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9wcml2YXRlL2VuZm9yY2UudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0FBZ0NBLDBEQU1DO0FBR0QsOENBRUM7QUFNRCw0Q0FFQztBQW1HRCxnREFpQkM7QUF1REQsd0NBaUJDO0FBYUQsc0NBUUM7QUFnQ0QsZ0NBZUM7QUFuVEQsdUNBQXlCO0FBQ3pCLDJDQUE2QjtBQUM3Qiw2Q0FNcUI7QUFFckIsd0RBQXdFO0FBRXhFLDBEQUEwRDtBQUMxRDs4REFDOEQ7QUFFOUQ7OztHQUdHO0FBQ1UsUUFBQSxzQkFBc0IsR0FBRyx3QkFBd0IsQ0FBQztBQUUvRDs7Ozs7Ozs7O0dBU0c7QUFDSCxTQUFnQix1QkFBdUIsQ0FBQyxNQUFjLEVBQUUsU0FBa0I7SUFDeEUsTUFBTSxPQUFPLEdBQUcsaUJBQWlCLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxDQUFDLHFCQUFxQixJQUFJLENBQUMsU0FBUyxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztJQUN2RyxPQUFPO1FBQ0wsSUFBSSxFQUFFLDhCQUFzQjtRQUM1QixPQUFPLEVBQUUsK0RBQStELElBQUksQ0FBQyxTQUFTLENBQUMsTUFBTSxDQUFDLEtBQUssT0FBTyxFQUFFO0tBQzdHLENBQUM7QUFDSixDQUFDO0FBRUQseUZBQXlGO0FBQ3pGLFNBQWdCLGlCQUFpQixDQUFDLFNBQTZCO0lBQzdELE9BQU8sT0FBTyxTQUFTLEtBQUssUUFBUSxJQUFJLFVBQVUsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUM7QUFDckUsQ0FBQztBQUVEOzs7R0FHRztBQUNILFNBQWdCLGdCQUFnQixDQUFDLE1BQTBCO0lBQ3pELE9BQU8sT0FBTyxNQUFNLEtBQUssUUFBUSxJQUFJLDBCQUEwQixDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQztBQUMvRSxDQUFDO0FBWUQ7Ozs7Ozs7R0FPRztBQUNILE1BQWEsc0JBQXNCO0lBSWQ7SUFDQTtJQUpILElBQUksR0FBRyxtQkFBVyxDQUFDO0lBRW5DLFlBQ21CLEtBQXdCLEVBQ3hCLE1BQWU7UUFEZixVQUFLLEdBQUwsS0FBSyxDQUFtQjtRQUN4QixXQUFNLEdBQU4sTUFBTSxDQUFTO0lBQy9CLENBQUM7SUFFRyxRQUFRLENBQUMsT0FBaUM7UUFDL0MsTUFBTSxNQUFNLEdBQUcsZ0JBQWdCLEVBQUUsQ0FBQztRQUNsQyxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUM7WUFDWixzQ0FBc0M7WUFDdEMsT0FBTyxDQUFDLEtBQUssQ0FDWCxpRUFBaUU7Z0JBQ2pFLGdFQUFnRTtnQkFDaEUsK0RBQStELENBQ2hFLENBQUM7WUFDRixPQUFPLEVBQUUsT0FBTyxFQUFFLElBQUksRUFBRSxVQUFVLEVBQUUsRUFBRSxFQUFFLENBQUM7UUFDM0MsQ0FBQztRQUVELE1BQU0sTUFBTSxHQUFHLGdCQUFnQixDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO1FBQzdFLE1BQU0sT0FBTyxHQUFHLGlCQUFpQixDQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO1FBQ3JGLE1BQU0sR0FBRyxHQUFHLGdCQUFnQixDQUFDLE1BQU0sRUFBRSxJQUFJLENBQUMsS0FBSyxFQUFFLE1BQU0sRUFBRSxPQUFPLENBQUMsQ0FBQztRQUNsRSxNQUFNLElBQUksR0FBRyxJQUFJLEdBQUcsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDbEQsTUFBTSxVQUFVLEdBQXNCLEVBQUUsQ0FBQztRQUV6QyxLQUFLLE1BQU0sRUFBRSxJQUFJLE9BQU8sQ0FBQyxjQUFjLEVBQUUsQ0FBQztZQUN4QyxNQUFNLE1BQU0sR0FBRyxHQUFHLENBQUMsZ0JBQWdCLENBQUMsSUFBSSxNQUFNLENBQUMsWUFBWSxDQUFDLEVBQUUsQ0FBQyxZQUFZLENBQUMsRUFBRTtnQkFDNUUsd0JBQXdCLEVBQUU7b0JBQ3hCLFNBQVMsRUFBRSxPQUFPLENBQUMsU0FBUztvQkFDNUIsTUFBTSxFQUFFLE9BQU8sQ0FBQyxNQUFNO2lCQUN2QjthQUNGLENBQUMsQ0FBQztZQUNILEtBQUssTUFBTSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxJQUFJLEVBQUUsQ0FBdUIsRUFBRSxDQUFDO2dCQUNqRSxNQUFNLE1BQU0sR0FBRyxDQUFDLENBQUMsTUFBTSxLQUFLLFFBQVEsSUFBSSxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsQ0FBQztnQkFDM0QsTUFBTSxXQUFXLEdBQUcsSUFBSSxDQUFDLE1BQU07dUJBQzFCLENBQUMsQ0FBQyxNQUFNLEtBQUssUUFBUTt1QkFDckIsQ0FBQyxDQUFDLENBQUMsUUFBUSxLQUFLLE9BQU8sSUFBSSxDQUFDLENBQUMsUUFBUSxLQUFLLE9BQU8sQ0FBQyxDQUFDO2dCQUN4RCxJQUFJLENBQUMsTUFBTSxJQUFJLENBQUMsV0FBVztvQkFBRSxTQUFTO2dCQUN0QyxVQUFVLENBQUMsSUFBSSxDQUFDO29CQUNkLFFBQVEsRUFBRSxDQUFDLENBQUMsTUFBTTtvQkFDbEIsV0FBVyxFQUFFLENBQUMsQ0FBQyxPQUFPO29CQUN0QixRQUFRLEVBQUUsT0FBTztvQkFDakIsa0JBQWtCLEVBQUUsQ0FBQzs0QkFDbkIsaUJBQWlCLEVBQUUsQ0FBQyxDQUFDLE1BQU0sRUFBRSxTQUFTLElBQUksV0FBVzs0QkFDckQsWUFBWSxFQUFFLEVBQUUsQ0FBQyxZQUFZOzRCQUM3QixTQUFTLEVBQUUsQ0FBQyxDQUFDLENBQUMsWUFBWSxJQUFJLFlBQVksQ0FBQzt5QkFDNUMsQ0FBQztvQkFDRixHQUFHLENBQUMsQ0FBQyxDQUFDLGdCQUFnQixDQUFDLENBQUMsQ0FBQyxFQUFFLFlBQVksRUFBRSxFQUFFLGdCQUFnQixFQUFFLENBQUMsQ0FBQyxnQkFBZ0IsRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztpQkFDMUYsQ0FBQyxDQUFDO1lBQ0wsQ0FBQztRQUNILENBQUM7UUFFRCxPQUFPLEVBQUUsT0FBTyxFQUFFLFVBQVUsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLFVBQVUsRUFBRSxDQUFDO0lBQzFELENBQUM7Q0FDRjtBQXZERCx3REF1REM7QUFFRCw2RUFBNkU7QUFDaEUsUUFBQSxXQUFXLEdBQUcsZUFBZSxDQUFDO0FBRTNDLHVFQUF1RTtBQUN2RSxNQUFNLHNCQUFzQixHQUFHLHdCQUF3QixDQUFDO0FBRXhELE1BQU0sY0FBYyxHQUFHLE1BQU0sQ0FBQyxHQUFHLENBQUMsMkJBQTJCLENBQUMsQ0FBQztBQUUvRDs7Ozs7Ozs7Ozs7OztHQWFHO0FBQ0gsU0FBZ0Isa0JBQWtCLENBQUMsS0FBaUI7SUFDbEQsTUFBTSxJQUFJLEdBQUcsS0FBSyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUM7SUFDN0IsSUFBSSxDQUFDLGlCQUFHLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQztRQUFFLE9BQU87SUFDN0IsTUFBTSxHQUFHLEdBQUcsSUFBNEMsQ0FBQztJQUN6RCxJQUFJLEdBQUcsQ0FBQyxjQUFjLENBQUM7UUFBRSxPQUFPO0lBQ2hDLE1BQU0sQ0FBQyxjQUFjLENBQUMsR0FBRyxFQUFFLGNBQWMsRUFBRSxFQUFFLEtBQUssRUFBRSxJQUFJLEVBQUUsVUFBVSxFQUFFLEtBQUssRUFBRSxDQUFDLENBQUM7SUFFL0UsTUFBTSxLQUFLLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUM7SUFDbEMsSUFBSSxPQUFPLEdBQUcsS0FBSyxDQUFDO0lBQ3BCLEdBQUcsQ0FBQyxLQUFLLEdBQUcsQ0FBQyxPQUFxQyxFQUFFLEVBQUU7UUFDcEQsTUFBTSxRQUFRLEdBQUcsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ2hDLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztZQUNiLE9BQU8sR0FBRyxJQUFJLENBQUM7WUFDZixxQkFBcUIsQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDNUMsQ0FBQztRQUNELE9BQU8sUUFBUSxDQUFDO0lBQ2xCLENBQUMsQ0FBQztBQUNKLENBQUM7QUFFRDs7Ozs7OztHQU9HO0FBQ0gsU0FBUyxxQkFBcUIsQ0FBQyxTQUFpQjtJQUM5QyxJQUFJLGFBQW9CLENBQUM7SUFDekIsSUFBSSxDQUFDO1FBQ0gsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsWUFBWSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxFQUFFLHNCQUFzQixDQUFDLEVBQUUsTUFBTSxDQUFDLENBQUMsQ0FBQztRQUNqRyxhQUFhLEdBQUcsTUFBTSxFQUFFLGFBQWEsSUFBSSxFQUFFLENBQUM7SUFDOUMsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLG9DQUFvQztRQUNwQyxPQUFPO0lBQ1QsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFHLGFBQWEsQ0FBQyxJQUFJLENBQy9CLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLEVBQUUsVUFBVSxLQUFLLG1CQUFXLElBQUksQ0FBQyxFQUFFLFVBQVUsS0FBSyxTQUFTLENBQ3BFLENBQUM7SUFDRixJQUFJLENBQUMsTUFBTTtRQUFFLE9BQU87SUFFcEIsc0NBQXNDO0lBQ3RDLE9BQU8sQ0FBQyxLQUFLLENBQUMsYUFBYSxDQUFDLGFBQWEsQ0FBQyxDQUFDLENBQUM7SUFDNUMsTUFBTSxJQUFJLEtBQUssQ0FDYiw0REFBNEQ7UUFDNUQsK0ZBQStGO1FBQy9GLG1FQUFtRSxDQUNwRSxDQUFDO0FBQ0osQ0FBQztBQUVEOzs7O0dBSUc7QUFDSCxTQUFTLGFBQWEsQ0FBQyxhQUFvQjtJQUN6QyxNQUFNLFNBQVMsR0FBRyxtQkFBbUIsRUFBRSxDQUFDO0lBQ3hDLElBQUksU0FBUyxFQUFFLENBQUM7UUFDZCxJQUFJLENBQUM7WUFDSCxPQUFPLFNBQVMsQ0FBQyx1QkFBdUIsQ0FBQyxPQUFPLENBQUMsR0FBRyxFQUFFLEVBQUUsYUFBYSxDQUFDLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQ3RGLENBQUM7UUFBQyxNQUFNLENBQUM7WUFDUCxlQUFlO1FBQ2pCLENBQUM7SUFDSCxDQUFDO0lBQ0QsT0FBTyxjQUFjLENBQUMsYUFBYSxDQUFDLENBQUM7QUFDdkMsQ0FBQztBQUVEOzs7O0dBSUc7QUFDSCxTQUFnQixjQUFjLENBQUMsYUFBb0I7SUFDakQsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLEtBQUssTUFBTSxNQUFNLElBQUksYUFBYSxFQUFFLENBQUM7UUFDbkMsS0FBSyxNQUFNLFNBQVMsSUFBSSxNQUFNLEVBQUUsVUFBVSxJQUFJLEVBQUUsRUFBRSxDQUFDO1lBQ2pELE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQztnQkFDckQsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxRQUFRO2dCQUNwQixDQUFDLENBQUMsR0FBRyxNQUFNLENBQUMsVUFBVSxLQUFLLFNBQVMsQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUNsRCxLQUFLLE1BQU0sQ0FBQyxJQUFJLFNBQVMsQ0FBQyxtQkFBbUIsSUFBSSxFQUFFLEVBQUUsQ0FBQztnQkFDcEQsTUFBTSxDQUFDLElBQUksQ0FDVCxHQUFHLE1BQU0sQ0FBQyxTQUFTLENBQUMsUUFBUSxJQUFJLE9BQU8sQ0FBQyxDQUFDLFdBQVcsRUFBRSxJQUFJLFNBQVMsQ0FBQyxXQUFXLEtBQUssTUFBTSxDQUFDLFVBQVUsS0FBSztvQkFDMUcsTUFBTSxDQUFDLENBQUMsYUFBYSxLQUFLLENBQUMsQ0FBQyxzQkFBc0IsRUFBRSxTQUFTLEtBQUssQ0FBQyxDQUFDLFlBQVksSUFBSTtvQkFDcEYsd0JBQXdCLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFLEdBQUcsQ0FBQyxHQUFHLENBQzVELENBQUM7WUFDSixDQUFDO1FBQ0gsQ0FBQztJQUNILENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUM7QUFDN0IsQ0FBQztBQUVELG1EQUFtRDtBQUNuRCw4Q0FBOEM7QUFDOUMsSUFBSSxlQUF3QyxDQUFDO0FBQzdDLFNBQVMsbUJBQW1CO0lBQzFCLElBQUksZUFBZSxLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQ2xDLGVBQWUsR0FBRyxhQUFhLEVBQUUsSUFBSSxLQUFLLENBQUM7SUFDN0MsQ0FBQztJQUNELE9BQU8sZUFBZSxLQUFLLEtBQUssQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxlQUFlLENBQUM7QUFDakUsQ0FBQztBQUVELGlDQUFpQztBQUNqQyxTQUFnQixhQUFhO0lBQzNCLElBQUksQ0FBQztRQUNILE1BQU0sT0FBTyxHQUFHLElBQUksQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQywwQkFBMEIsQ0FBQyxDQUFDLENBQUM7UUFDMUUsTUFBTSxHQUFHLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxFQUFFLGlEQUFpRCxDQUFDLENBQUMsQ0FBQztRQUMzRixPQUFPLE9BQU8sR0FBRyxFQUFFLHVCQUF1QixLQUFLLFVBQVUsQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7SUFDOUUsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sU0FBUyxDQUFDO0lBQ25CLENBQUM7QUFDSCxDQUFDO0FBRUQsdUNBQXVDO0FBQ3ZDLElBQUksa0JBQTJDLENBQUM7QUFDaEQsU0FBUyxnQkFBZ0I7SUFDdkIsSUFBSSxrQkFBa0IsS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUNyQyxrQkFBa0IsR0FBRyxVQUFVLEVBQUUsSUFBSSxLQUFLLENBQUM7SUFDN0MsQ0FBQztJQUNELE9BQU8sa0JBQWtCLEtBQUssS0FBSyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLGtCQUFrQixDQUFDO0FBQ3ZFLENBQUM7QUFFRCxNQUFNLGVBQWUsR0FBRyxJQUFJLEdBQUcsRUFBZSxDQUFDO0FBQy9DLFNBQVMsZ0JBQWdCLENBQUMsWUFBaUIsRUFBRSxLQUF3QixFQUFFLE1BQWUsRUFBRSxPQUFnQjtJQUN0RyxNQUFNLEdBQUcsR0FBRyxHQUFHLE1BQU0sSUFBSSxFQUFFLElBQUksT0FBTyxJQUFJLEVBQUUsSUFBSSxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7SUFDbkYsSUFBSSxDQUFDLGVBQWUsQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUM5QixNQUFNLFdBQVcsR0FBRztZQUNsQixHQUFHLDhCQUFZLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQyxJQUFJLEVBQUUsT0FBTyxFQUFFLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDO1lBQy9ELEdBQUcsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxFQUFFLElBQUksRUFBRSxDQUFDLENBQUMsRUFBRSxFQUFFLE9BQU8sRUFBRSxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQztTQUN2RCxDQUFDO1FBQ0YsSUFBSSxNQUFNLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDekIsV0FBVyxDQUFDLElBQUksQ0FBQyx1QkFBdUIsQ0FBQyxNQUFNLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQztRQUM3RCxDQUFDO1FBQ0QsZUFBZSxDQUFDLEdBQUcsQ0FBQyxHQUFHLEVBQUUsSUFBSSxZQUFZLENBQUMsVUFBVSxDQUFDLEVBQUUsV0FBVyxFQUFFLENBQUMsQ0FBQyxDQUFDO0lBQ3pFLENBQUM7SUFDRCxPQUFPLGVBQWUsQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUM7QUFDbEMsQ0FBQztBQUVEOzs7O0dBSUc7QUFDSCxTQUFnQixVQUFVO0lBQ3hCLElBQUksQ0FBQztRQUNILE9BQU8sT0FBTyxDQUFDLDhCQUE4QixDQUFDLENBQUM7SUFDakQsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLGVBQWU7SUFDakIsQ0FBQztJQUNELElBQUksQ0FBQztRQUNILE1BQU0sTUFBTSxHQUFHLE9BQU8sQ0FBQyxPQUFPLENBQUMsMEJBQTBCLENBQUMsQ0FBQztRQUMzRCxNQUFNLE1BQU0sR0FBRyxPQUFPLENBQUMsT0FBTyxDQUFDLDJDQUEyQyxFQUFFO1lBQzFFLEtBQUssRUFBRSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLENBQUM7U0FDOUIsQ0FBQyxDQUFDO1FBQ0gsT0FBTyxPQUFPLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO0lBQ3ZDLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLFNBQVMsQ0FBQztJQUNuQixDQUFDO0FBQ0gsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCAqIGFzIGZzIGZyb20gJ2ZzJztcbmltcG9ydCAqIGFzIHBhdGggZnJvbSAncGF0aCc7XG5pbXBvcnQge1xuICBBcHAsXG4gIHR5cGUgSVBvbGljeVZhbGlkYXRpb25Db250ZXh0LFxuICB0eXBlIElQb2xpY3lWYWxpZGF0aW9uUGx1Z2luLFxuICB0eXBlIFBvbGljeVZhbGlkYXRpb25QbHVnaW5SZXBvcnQsXG4gIHR5cGUgUG9saWN5VmlvbGF0aW9uLFxufSBmcm9tICdhd3MtY2RrLWxpYic7XG5pbXBvcnQgdHlwZSB7IElDb25zdHJ1Y3QgfSBmcm9tICdjb25zdHJ1Y3RzJztcbmltcG9ydCB7IEJVTkRMRURfTElCUywgdHlwZSBCdW5kbGVkUnVsZURhdGEgfSBmcm9tICcuLi9ydWxlcy5nZW5lcmF0ZWQnO1xuXG4vKiBlc2xpbnQtZGlzYWJsZSBAdHlwZXNjcmlwdC1lc2xpbnQvbm8tcmVxdWlyZS1pbXBvcnRzICovXG4vKiBlc2xpbnQtZGlzYWJsZSBpbXBvcnQvbm8tZXh0cmFuZW91cy1kZXBlbmRlbmNpZXMgLS0gQGF3cy9jbG91ZGZvcm1hdGlvbi12YWxpZGF0ZSDjga9cbiAgIGF3cy1jZGstbGliIOWQjOaiseOCs+ODlOODvOOCkuWLleeahOino+axuuOBmeOCi+ioreioiO+8iOS+neWtmOOBq+OBr+i8ieOBm+OBquOBhO+8ieOAglJFQURNRS9BR0VOVFMubWQg5Y+C54WnICovXG5cbi8qKlxuICogVGhlIG5hbWUgb2YgdGhlIGdlbmVyYXRlZCBSZWdvIG1vZHVsZSB0aGF0IGNhcnJpZXMgdGhlIGRlcGxveW1lbnRcbiAqIGVudmlyb25tZW50IGludG8gcnVsZSBldmFsdWF0aW9uLlxuICovXG5leHBvcnQgY29uc3QgREVQTE9ZX0VOVl9NT0RVTEVfTkFNRSA9ICdfcGZfZGVwbG95X2Vudmlyb25tZW50JztcblxuLyoqXG4gKiBCdWlsZCB0aGUgZ2VuZXJhdGVkIG1vZHVsZSBkZWZpbmluZyBgZGVwbG95X3JlZ2lvbmAgZm9yIHRoZSBydWxlIHBhY2thZ2UuXG4gKlxuICogUnVsZXMgbXVzdCByZWFkIGl0IGFzIGBkYXRhLmNka19wcmVmbGlnaHQuZGVwbG95X3JlZ2lvbmAgKG5ldmVyIGFzIGEgYmFyZVxuICogdmFyaWFibGUpOiB0aGUgZGF0YSByZWZlcmVuY2UgaXMgc2ltcGx5IHVuZGVmaW5lZCB3aGVuIHRoZSBtb2R1bGUgaXMgbm90XG4gKiBpbmplY3RlZCDigJQgdGhlIHJ1bGUgYm9keSBmYWlscyBhbmQgdGhlIHJ1bGUgc2tpcHMg4oCUIHdoaWxlIGEgYmFyZSB2YXJpYWJsZVxuICogd291bGQgYmUgYSBjb21waWxlIGVycm9yLiBJbmplY3RlZCBieSB0aGUgZW5mb3JjZSBwbHVnaW4gd2hlbiB0aGUgYXBwLWxldmVsXG4gKiByZWdpb24gaXMgY29uY3JldGU7IHRoZSB3YXJuIG1vZGUgKENESyBidWlsdC1pbiBwbHVnaW4pIG5ldmVyIGluamVjdHMgaXQsXG4gKiBzbyByZWdpb24tZGVwZW5kZW50IHJ1bGVzIG9ubHkgZmlyZSBpbiBlbmZvcmNlIG1vZGUuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBkZXBsb3lFbnZpcm9ubWVudE1vZHVsZShyZWdpb246IHN0cmluZywgYWNjb3VudElkPzogc3RyaW5nKTogeyBuYW1lOiBzdHJpbmc7IGNvbnRlbnQ6IHN0cmluZyB9IHtcbiAgY29uc3QgYWNjb3VudCA9IGlzQ29uY3JldGVBY2NvdW50KGFjY291bnRJZCkgPyBgZGVwbG95X2FjY291bnQgOj0gJHtKU09OLnN0cmluZ2lmeShhY2NvdW50SWQpfVxcbmAgOiAnJztcbiAgcmV0dXJuIHtcbiAgICBuYW1lOiBERVBMT1lfRU5WX01PRFVMRV9OQU1FLFxuICAgIGNvbnRlbnQ6IGBwYWNrYWdlIGNka19wcmVmbGlnaHRcXG5cXG5pbXBvcnQgcmVnby52MVxcblxcbmRlcGxveV9yZWdpb24gOj0gJHtKU09OLnN0cmluZ2lmeShyZWdpb24pfVxcbiR7YWNjb3VudH1gLFxuICB9O1xufVxuXG4vKiogV2hldGhlciB0aGUgYWNjb3VudCBmcm9tIHRoZSB2YWxpZGF0aW9uIGNvbnRleHQgaXMgYSBjb25jcmV0ZSAxMi1kaWdpdCBhY2NvdW50IGlkLiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGlzQ29uY3JldGVBY2NvdW50KGFjY291bnRJZDogc3RyaW5nIHwgdW5kZWZpbmVkKTogYWNjb3VudElkIGlzIHN0cmluZyB7XG4gIHJldHVybiB0eXBlb2YgYWNjb3VudElkID09PSAnc3RyaW5nJyAmJiAvXlxcZHsxMn0kLy50ZXN0KGFjY291bnRJZCk7XG59XG5cbi8qKlxuICogV2hldGhlciB0aGUgcmVnaW9uIGZyb20gdGhlIHZhbGlkYXRpb24gY29udGV4dCBpcyBhIGNvbmNyZXRlIHJlZ2lvbiBuYW1lXG4gKiAoYXMgb3Bwb3NlZCB0byB1bmRlZmluZWQsIGFuIHVucmVzb2x2ZWQgdG9rZW4sIG9yIGEgcGxhY2Vob2xkZXIpLlxuICovXG5leHBvcnQgZnVuY3Rpb24gaXNDb25jcmV0ZVJlZ2lvbihyZWdpb246IHN0cmluZyB8IHVuZGVmaW5lZCk6IHJlZ2lvbiBpcyBzdHJpbmcge1xuICByZXR1cm4gdHlwZW9mIHJlZ2lvbiA9PT0gJ3N0cmluZycgJiYgL15bYS16XXsyfSgtW2Etel0rKSstXFxkKyQvLnRlc3QocmVnaW9uKTtcbn1cblxuaW50ZXJmYWNlIEVuZ2luZURpYWdub3N0aWMge1xuICByZWFkb25seSBydWxlSWQ6IHN0cmluZztcbiAgcmVhZG9ubHkgc2V2ZXJpdHk6IHN0cmluZztcbiAgcmVhZG9ubHkgbWVzc2FnZTogc3RyaW5nO1xuICByZWFkb25seSBzb3VyY2U/OiBzdHJpbmc7XG4gIHJlYWRvbmx5IGVudGl0eT86IHsgcmVhZG9ubHkgbG9naWNhbElkPzogc3RyaW5nIH07XG4gIHJlYWRvbmx5IHByb3BlcnR5UGF0aD86IHN0cmluZztcbiAgcmVhZG9ubHkgZG9jdW1lbnRhdGlvblVybD86IHN0cmluZztcbn1cblxuLyoqXG4gKiBlbmZvcmNlIOODouODvOODieeUqOOBruWGhemDqOODl+ODqeOCsOOCpOODs+OAglxuICpcbiAqIENESyDntYTjgb/ovrzjgb/jga4gQ2xvdWRGb3JtYXRpb25WYWxpZGF0ZVBsdWdpbiDjga/lhaggZmluZGluZyDjgpIgd2FybmluZyDjgavkuLjjgoHjgovjgZ/jgoFcbiAqIO+8iGF3cy1jZGstbGliIDIuMjY3LjAg5a6f5ris44CB5piH5qC844OV44Op44Kw44KC54Sh5Yq577yJ44CB5ZCM44GY44Ko44Oz44K444Oz44KS55u05o6l5ZG844Gz44CBXG4gKiBjZGstcHJlZmxpZ2h0IOOBruODq+ODvOODq+mBleWPje+8iOOBiuOCiOOBsyBzdHJpY3Qg5pmC44Gv44Ko44Oz44K444Oz44Gu44Ko44Op44O844Kv44Op44K577yJ44KSXG4gKiBwb2xpY3kgdmFsaWRhdGlvbiDjga7lpLHmlZfjgajjgZfjgabloLHlkYrjgZfjgaYgc3ludGgg44KS5q2i44KB44KL44CCXG4gKi9cbmV4cG9ydCBjbGFzcyBQcmVmbGlnaHRFbmZvcmNlUGx1Z2luIGltcGxlbWVudHMgSVBvbGljeVZhbGlkYXRpb25QbHVnaW4ge1xuICBwdWJsaWMgcmVhZG9ubHkgbmFtZSA9IFBMVUdJTl9OQU1FO1xuXG4gIGNvbnN0cnVjdG9yKFxuICAgIHByaXZhdGUgcmVhZG9ubHkgcnVsZXM6IEJ1bmRsZWRSdWxlRGF0YVtdLFxuICAgIHByaXZhdGUgcmVhZG9ubHkgc3RyaWN0OiBib29sZWFuLFxuICApIHt9XG5cbiAgcHVibGljIHZhbGlkYXRlKGNvbnRleHQ6IElQb2xpY3lWYWxpZGF0aW9uQ29udGV4dCk6IFBvbGljeVZhbGlkYXRpb25QbHVnaW5SZXBvcnQge1xuICAgIGNvbnN0IGVuZ2luZSA9IGxvYWRFbmdpbmVDYWNoZWQoKTtcbiAgICBpZiAoIWVuZ2luZSkge1xuICAgICAgLy8gZXNsaW50LWRpc2FibGUtbmV4dC1saW5lIG5vLWNvbnNvbGVcbiAgICAgIGNvbnNvbGUuZXJyb3IoXG4gICAgICAgICdjZGstcHJlZmxpZ2h0OiBjb3VsZCBub3QgcmVzb2x2ZSBAYXdzL2Nsb3VkZm9ybWF0aW9uLXZhbGlkYXRlOyAnICtcbiAgICAgICAgJ2VuZm9yY2UgbW9kZSBpcyB1bmF2YWlsYWJsZSBhbmQgbm8gcHJlZmxpZ2h0IGNoZWNrcyB3ZXJlIHJ1bi4gJyArXG4gICAgICAgICdJbnN0YWxsIGl0IGFzIGEgZGV2RGVwZW5kZW5jeSBvciB1c2UgdGhlIGRlZmF1bHQgKHdhcm4pIG1vZGUuJyxcbiAgICAgICk7XG4gICAgICByZXR1cm4geyBzdWNjZXNzOiB0cnVlLCB2aW9sYXRpb25zOiBbXSB9O1xuICAgIH1cblxuICAgIGNvbnN0IHJlZ2lvbiA9IGlzQ29uY3JldGVSZWdpb24oY29udGV4dC5yZWdpb24pID8gY29udGV4dC5yZWdpb24gOiB1bmRlZmluZWQ7XG4gICAgY29uc3QgYWNjb3VudCA9IGlzQ29uY3JldGVBY2NvdW50KGNvbnRleHQuYWNjb3VudElkKSA/IGNvbnRleHQuYWNjb3VudElkIDogdW5kZWZpbmVkO1xuICAgIGNvbnN0IGVuZyA9IHJlZ29FbmdpbmVDYWNoZWQoZW5naW5lLCB0aGlzLnJ1bGVzLCByZWdpb24sIGFjY291bnQpO1xuICAgIGNvbnN0IG91cnMgPSBuZXcgU2V0KHRoaXMucnVsZXMubWFwKChyKSA9PiByLmlkKSk7XG4gICAgY29uc3QgdmlvbGF0aW9uczogUG9saWN5VmlvbGF0aW9uW10gPSBbXTtcblxuICAgIGZvciAoY29uc3Qgc3Qgb2YgY29udGV4dC5zdGFja1RlbXBsYXRlcykge1xuICAgICAgY29uc3QgcmVwb3J0ID0gZW5nLnZhbGlkYXRlRGV0YWlsZWQobmV3IGVuZ2luZS5UZW1wbGF0ZUZpbGUoc3QudGVtcGxhdGVQYXRoKSwge1xuICAgICAgICBwc2V1ZG9QYXJhbWV0ZXJPdmVycmlkZXM6IHtcbiAgICAgICAgICBhY2NvdW50SWQ6IGNvbnRleHQuYWNjb3VudElkLFxuICAgICAgICAgIHJlZ2lvbjogY29udGV4dC5yZWdpb24sXG4gICAgICAgIH0sXG4gICAgICB9KTtcbiAgICAgIGZvciAoY29uc3QgZCBvZiAocmVwb3J0LmRpYWdub3N0aWNzID8/IFtdKSBhcyBFbmdpbmVEaWFnbm9zdGljW10pIHtcbiAgICAgICAgY29uc3QgaXNPdXJzID0gZC5zb3VyY2UgPT09ICdDVVNUT00nICYmIG91cnMuaGFzKGQucnVsZUlkKTtcbiAgICAgICAgY29uc3QgaXNTdHJpY3RIaXQgPSB0aGlzLnN0cmljdFxuICAgICAgICAgICYmIGQuc291cmNlICE9PSAnQ1VTVE9NJ1xuICAgICAgICAgICYmIChkLnNldmVyaXR5ID09PSAnRVJST1InIHx8IGQuc2V2ZXJpdHkgPT09ICdGQVRBTCcpO1xuICAgICAgICBpZiAoIWlzT3VycyAmJiAhaXNTdHJpY3RIaXQpIGNvbnRpbnVlO1xuICAgICAgICB2aW9sYXRpb25zLnB1c2goe1xuICAgICAgICAgIHJ1bGVOYW1lOiBkLnJ1bGVJZCxcbiAgICAgICAgICBkZXNjcmlwdGlvbjogZC5tZXNzYWdlLFxuICAgICAgICAgIHNldmVyaXR5OiAnZXJyb3InLFxuICAgICAgICAgIHZpb2xhdGluZ1Jlc291cmNlczogW3tcbiAgICAgICAgICAgIHJlc291cmNlTG9naWNhbElkOiBkLmVudGl0eT8ubG9naWNhbElkID8/ICcodW5rbm93biknLFxuICAgICAgICAgICAgdGVtcGxhdGVQYXRoOiBzdC50ZW1wbGF0ZVBhdGgsXG4gICAgICAgICAgICBsb2NhdGlvbnM6IFtkLnByb3BlcnR5UGF0aCA/PyAnKHRlbXBsYXRlKSddLFxuICAgICAgICAgIH1dLFxuICAgICAgICAgIC4uLihkLmRvY3VtZW50YXRpb25VcmwgPyB7IHJ1bGVNZXRhZGF0YTogeyBEb2N1bWVudGF0aW9uVXJsOiBkLmRvY3VtZW50YXRpb25VcmwgfSB9IDoge30pLFxuICAgICAgICB9KTtcbiAgICAgIH1cbiAgICB9XG5cbiAgICByZXR1cm4geyBzdWNjZXNzOiB2aW9sYXRpb25zLmxlbmd0aCA9PT0gMCwgdmlvbGF0aW9ucyB9O1xuICB9XG59XG5cbi8qKiBUaGUgcGx1Z2luIG5hbWUgcmVjb3JkZWQgaW4gYHZhbGlkYXRpb24tcmVwb3J0Lmpzb25gIGZvciBvdXIgZmluZGluZ3MuICovXG5leHBvcnQgY29uc3QgUExVR0lOX05BTUUgPSAnY2RrLXByZWZsaWdodCc7XG5cbi8qKiBUaGUgY2xvdWQgYXNzZW1ibHkgZmlsZSB0aGUgQ0RLIHdyaXRlcyBpdHMgdmFsaWRhdGlvbiByZXBvcnQgdG8uICovXG5jb25zdCBWQUxJREFUSU9OX1JFUE9SVF9GSUxFID0gJ3ZhbGlkYXRpb24tcmVwb3J0Lmpzb24nO1xuXG5jb25zdCBHQVRFX0lOU1RBTExFRCA9IFN5bWJvbC5mb3IoJ2Nkay1wcmVmbGlnaHQuZW5mb3JjZUdhdGUnKTtcblxuLyoqXG4gKiBlbmZvcmNlIOODouODvOODieOBruWPluOCiuOBk+OBvOOBl+OCkuWhnuOBkOOCsuODvOODiOOCkiBBcHAg44Gr5LuV6L6844KA44CCXG4gKlxuICogQ0RLIENMSSAyLjExMjguMSDku6XpmY3jga8gYXBwIOOBq+OAjOODrOODneODvOODiOOBryBDTEkg44GM5Yem55CG44GZ44KL44CN44Go5Lyd44GI44Gf44GG44GI44GnXG4gKiBgdmFsaWRhdGlvbi1yZXBvcnQuanNvbmAg44KS6Ieq5YiG44Gn6Kqt44KA44GM44CB44Gd44Gu57We44KK6L6844G/77yIdG9vbGtpdC1saWIg44GuXG4gKiBgZmlsdGVyUmVwb3J0c0J5U3RhY2tzYO+8ieOBjCB2aW9sYXRpb24g44GuIGNvbnN0cnVjdFBhdGgg5YWI6aCt44K744Kw44Oh44Oz44OI44KSXG4gKiDpgbjmip7jgrnjgr/jg4Pjgq/jga4gaGllcmFyY2hpY2FsSWQg44Go56qB44GN5ZCI44KP44Gb44KL44Gf44KB44CBYFN0YWdlL1N0YWNrYCDlvaLlvI/jgavjgarjgotcbiAqIFN0YWdlIOWGheOCueOCv+ODg+OCr+OBrumBleWPjeOBjOOBmeOBueOBpuaNqOOBpuOCieOCjOOAgXN5bnRoIOOBjOm7meOBo+OBpuaIkOWKn+OBmeOCi++8iGlzc3VlICMxMTPvvInjgIJcbiAqXG4gKiDjgZ3jgZPjgacgc3ludGgg5a6M5LqG5b6M44Gr44Os44Od44O844OI44KS6Kqt44G/55u044GX44CBY2RrLXByZWZsaWdodCDjga7pgZXlj43jgYzmrovjgaPjgabjgYTjgozjgbBcbiAqIOiHquWIhuOBp+WgseWRiuOBl+OBpiBzeW50aCDjgpLmraLjgoHjgovjgILjg6njgqTjg5bjg6njg6rjgYzoh6rlipvjgafloLHlkYrjgZnjgovntYzot6/vvIjntKDjga4gbm9kZSDlrp/ooYzjgIFcbiAqIGplc3TjgIFDTEkgMi4xMTI4LjEg5pyq5rqA77yJ44Gn44GvIHN5bnRoIOOBjOS+i+WkluOCkuaKleOBkuOCi+OBn+OCgeOBk+OBk+OBq+OBr+WIsOmBlOOBm+OBmuOAgVxuICog5LqM6YeN5aCx5ZGK44Gv6LW344GN44Gq44GE44CCXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBpbnN0YWxsRW5mb3JjZUdhdGUoc2NvcGU6IElDb25zdHJ1Y3QpOiB2b2lkIHtcbiAgY29uc3Qgcm9vdCA9IHNjb3BlLm5vZGUucm9vdDtcbiAgaWYgKCFBcHAuaXNBcHAocm9vdCkpIHJldHVybjtcbiAgY29uc3QgYXBwID0gcm9vdCBhcyBBcHAgJiB7IFtHQVRFX0lOU1RBTExFRF0/OiBib29sZWFuIH07XG4gIGlmIChhcHBbR0FURV9JTlNUQUxMRURdKSByZXR1cm47XG4gIE9iamVjdC5kZWZpbmVQcm9wZXJ0eShhcHAsIEdBVEVfSU5TVEFMTEVELCB7IHZhbHVlOiB0cnVlLCBlbnVtZXJhYmxlOiBmYWxzZSB9KTtcblxuICBjb25zdCBzeW50aCA9IGFwcC5zeW50aC5iaW5kKGFwcCk7XG4gIGxldCBjaGVja2VkID0gZmFsc2U7XG4gIGFwcC5zeW50aCA9IChvcHRpb25zPzogUGFyYW1ldGVyczxBcHBbJ3N5bnRoJ10+WzBdKSA9PiB7XG4gICAgY29uc3QgYXNzZW1ibHkgPSBzeW50aChvcHRpb25zKTtcbiAgICBpZiAoIWNoZWNrZWQpIHtcbiAgICAgIGNoZWNrZWQgPSB0cnVlO1xuICAgICAgZmFpbElmUmVwb3J0VW5oYW5kbGVkKGFzc2VtYmx5LmRpcmVjdG9yeSk7XG4gICAgfVxuICAgIHJldHVybiBhc3NlbWJseTtcbiAgfTtcbn1cblxuLyoqXG4gKiDjg6zjg53jg7zjg4jjgasgY2RrLXByZWZsaWdodCDjga7lpLHmlZfjgYzmrovjgaPjgabjgYTjgozjgbDjgIFmaW5kaW5ncyDjgpLlh7rlipvjgZfjgaYgc3ludGgg44KS5q2i44KB44KL44CCXG4gKlxuICog5Yik5a6a44GvIGNkay1wcmVmbGlnaHQg44Gu44Os44Od44O844OI44Gg44GR44KS6KaL44KL44CC57WE44G/6L6844G/44Ko44Oz44K444Oz44KEIGNvbnN0cnVjdCBhbm5vdGF0aW9uXG4gKiDjgaDjgZHjgYzlpLHmlZfjgZfjgabjgYTjgovloLTlkIjjga8gQ0xJIOOBjOato+OBl+OBj+aJseOBiOOCi+OBruOBp+OAgeOBk+OBoeOCieOBr+m7meOBo+OBpiBDTEkg44Gr5Lu744Gb44KL44CCXG4gKiDpgIbjgavnmbrngavjgZnjgovjgajjgY3jga/jg6zjg53jg7zjg4jlhajkvZPjgpLlh7rjgZnjgILjgZPjgZPjgacgc3ludGgg44KS5q2i44KB44KL44GoIENMSSDlgbTjga7lh7rlipvjgYxcbiAqIOS4gOWIh+i1sOOCieOBquOBhOOBn+OCgeOAgeWQjOaZguOBq+WHuuOBpuOBhOOBn+OBr+OBmuOBruS7luODl+ODqeOCsOOCpOODs+OBriBmaW5kaW5nIOOBjOa2iOOBiOOBpuOBl+OBvuOBhuOAglxuICovXG5mdW5jdGlvbiBmYWlsSWZSZXBvcnRVbmhhbmRsZWQoZGlyZWN0b3J5OiBzdHJpbmcpOiB2b2lkIHtcbiAgbGV0IHBsdWdpblJlcG9ydHM6IGFueVtdO1xuICB0cnkge1xuICAgIGNvbnN0IHJlcG9ydCA9IEpTT04ucGFyc2UoZnMucmVhZEZpbGVTeW5jKHBhdGguam9pbihkaXJlY3RvcnksIFZBTElEQVRJT05fUkVQT1JUX0ZJTEUpLCAndXRmOCcpKTtcbiAgICBwbHVnaW5SZXBvcnRzID0gcmVwb3J0Py5wbHVnaW5SZXBvcnRzID8/IFtdO1xuICB9IGNhdGNoIHtcbiAgICAvLyDjg6zjg53jg7zjg4jjgYznhKHjgYTvvIjjg5fjg6njgrDjgqTjg7PmnKrlrp/ooYzvvInjgb7jgZ/jga/lo4rjgozjgabjgYTjgovloLTlkIjjga/kvZXjgoLjgZfjgarjgYRcbiAgICByZXR1cm47XG4gIH1cbiAgY29uc3QgZmFpbGVkID0gcGx1Z2luUmVwb3J0cy5zb21lKFxuICAgIChyKSA9PiByPy5wbHVnaW5OYW1lID09PSBQTFVHSU5fTkFNRSAmJiByPy5jb25jbHVzaW9uID09PSAnZmFpbHVyZScsXG4gICk7XG4gIGlmICghZmFpbGVkKSByZXR1cm47XG5cbiAgLy8gZXNsaW50LWRpc2FibGUtbmV4dC1saW5lIG5vLWNvbnNvbGVcbiAgY29uc29sZS5lcnJvcihmb3JtYXRSZXBvcnRzKHBsdWdpblJlcG9ydHMpKTtcbiAgdGhyb3cgbmV3IEVycm9yKFxuICAgICdjZGstcHJlZmxpZ2h0OiB2YWxpZGF0aW9uIGZhaWxlZC4gRml4IHRoZSBmaW5kaW5ncyBhYm92ZSwgJyArXG4gICAgXCJhY2tub3dsZWRnZSB0aGVtIHdpdGggVmFsaWRhdGlvbnMub2Yoc2NvcGUpLmFja25vd2xlZGdlKHsgaWQ6ICdjZGstcHJlZmxpZ2h0Ojo8cnVsZS1pZD4nIH0pLCBcIiArXG4gICAgJ29yIGV4Y2x1ZGUgdGhlIHJ1bGUgdmlhIFByZWZsaWdodC5hcHBseShhcHAsIHsgZXhjbHVkZTogWy4uLl0gfSkuJyxcbiAgKTtcbn1cblxuLyoqXG4gKiBDREsg5pys5L2T44Gu44OV44Kp44O844Oe44OD44K/44Gn5pW05b2i44GX44CBQ0xJIOOBqOWQjOS4gOOBruimi+OBn+ebruOBq+OBmeOCi+OAglxuICog56eB5pyJ44OR44K544Gq44Gu44Gn6Kej5rG644Gn44GN44Gq44GE44GT44Go44GM44GC44KK44CB44Gd44Gu5aC05ZCI44Gv5pyA5bCP6ZmQ44Gu6Ieq5YmN5pW05b2i44Gr6JC944Go44GZXG4gKiDvvIjopovjgZ/nm67jgojjgorjgIzokL3jgajjgZnjgI3jgZPjgajjgpLlhKrlhYjjgZnjgovvvInjgIJcbiAqL1xuZnVuY3Rpb24gZm9ybWF0UmVwb3J0cyhwbHVnaW5SZXBvcnRzOiBhbnlbXSk6IHN0cmluZyB7XG4gIGNvbnN0IGZvcm1hdHRlciA9IGxvYWRGb3JtYXR0ZXJDYWNoZWQoKTtcbiAgaWYgKGZvcm1hdHRlcikge1xuICAgIHRyeSB7XG4gICAgICByZXR1cm4gZm9ybWF0dGVyLmZvcm1hdFZhbGlkYXRpb25SZXBvcnRzKHByb2Nlc3MuY3dkKCksIHBsdWdpblJlcG9ydHMpLmpvaW4oJ1xcblxcbicpO1xuICAgIH0gY2F0Y2gge1xuICAgICAgLy8gZmFsbCB0aHJvdWdoXG4gICAgfVxuICB9XG4gIHJldHVybiBmYWxsYmFja0Zvcm1hdChwbHVnaW5SZXBvcnRzKTtcbn1cblxuLyoqXG4gKiBDREsg5pys5L2T44Gu44OV44Kp44O844Oe44OD44K/44KS6Kej5rG644Gn44GN44Gq44GE44Go44GN44Gu5pyA5bCP6ZmQ44Gu5pW05b2i44CCXG4gKiDopovjgZ/nm67jga/liqPjgovjgYzjgIFmaW5kaW5ncyDjgpLlv4XjgZroqq3jgoHjgovlvaLjgaflh7rjgZnjgZ/jgoHjga7mnIDlvozjga7noKbjgIJcbiAqIO+8iOODhuOCueODiOOBi+OCieOCguWIqeeUqOOBmeOCi+OBn+OCgSBleHBvcnQg44GX44Gm44GE44KL77yJXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBmYWxsYmFja0Zvcm1hdChwbHVnaW5SZXBvcnRzOiBhbnlbXSk6IHN0cmluZyB7XG4gIGNvbnN0IGJsb2Nrczogc3RyaW5nW10gPSBbXTtcbiAgZm9yIChjb25zdCByZXBvcnQgb2YgcGx1Z2luUmVwb3J0cykge1xuICAgIGZvciAoY29uc3QgdmlvbGF0aW9uIG9mIHJlcG9ydD8udmlvbGF0aW9ucyA/PyBbXSkge1xuICAgICAgY29uc3QgYWNrSWQgPSBTdHJpbmcodmlvbGF0aW9uLnJ1bGVOYW1lKS5pbmNsdWRlcygnOjonKVxuICAgICAgICA/IHZpb2xhdGlvbi5ydWxlTmFtZVxuICAgICAgICA6IGAke3JlcG9ydC5wbHVnaW5OYW1lfTo6JHt2aW9sYXRpb24ucnVsZU5hbWV9YDtcbiAgICAgIGZvciAoY29uc3QgYyBvZiB2aW9sYXRpb24udmlvbGF0aW5nQ29uc3RydWN0cyA/PyBbXSkge1xuICAgICAgICBibG9ja3MucHVzaChcbiAgICAgICAgICBgJHtTdHJpbmcodmlvbGF0aW9uLnNldmVyaXR5ID8/ICdFUlJPUicpLnRvVXBwZXJDYXNlKCl9ICR7dmlvbGF0aW9uLmRlc2NyaXB0aW9ufSAoJHtyZXBvcnQucGx1Z2luTmFtZX0pXFxuYCArXG4gICAgICAgICAgYCAgICR7Yy5jb25zdHJ1Y3RQYXRofSAoJHtjLmNsb3VkRm9ybWF0aW9uUmVzb3VyY2U/LmxvZ2ljYWxJZH0pICR7Yy5jb25zdHJ1Y3RGcW59XFxuYCArXG4gICAgICAgICAgYCAgIEFja25vd2xlZGdlIHdpdGggJyR7U3RyaW5nKGFja0lkKS5yZXBsYWNlKC8gL2csICctJyl9J2AsXG4gICAgICAgICk7XG4gICAgICB9XG4gICAgfVxuICB9XG4gIHJldHVybiBibG9ja3Muam9pbignXFxuXFxuJyk7XG59XG5cbi8vIOODleOCqeODvOODnuODg+OCv+OBryBhd3MtY2RrLWxpYiDjga7np4HmnInjg5HjgrnjgavjgYLjgoogYGV4cG9ydHNgIOOBi+OCieimi+OBiOOBquOBhOOBn+OCgeOAgVxuLy8g44Ko44Oz44K444Oz6Kej5rG677yIbG9hZEVuZ2luZe+8ieOBqOWQjOOBmOOBj+ODkeODg+OCseODvOOCuOODq+ODvOODiOOBi+OCieOBrue1tuWvvuODkeOCueOBp+iqreOBv+i+vOOCgOOAglxubGV0IGNhY2hlZEZvcm1hdHRlcjogYW55IHwgZmFsc2UgfCB1bmRlZmluZWQ7XG5mdW5jdGlvbiBsb2FkRm9ybWF0dGVyQ2FjaGVkKCk6IGFueSB8IHVuZGVmaW5lZCB7XG4gIGlmIChjYWNoZWRGb3JtYXR0ZXIgPT09IHVuZGVmaW5lZCkge1xuICAgIGNhY2hlZEZvcm1hdHRlciA9IGxvYWRGb3JtYXR0ZXIoKSA/PyBmYWxzZTtcbiAgfVxuICByZXR1cm4gY2FjaGVkRm9ybWF0dGVyID09PSBmYWxzZSA/IHVuZGVmaW5lZCA6IGNhY2hlZEZvcm1hdHRlcjtcbn1cblxuLyoqIO+8iOODhuOCueODiOOBi+OCieOCguWIqeeUqOOBmeOCi+OBn+OCgSBleHBvcnQg44GX44Gm44GE44KL77yJICovXG5leHBvcnQgZnVuY3Rpb24gbG9hZEZvcm1hdHRlcigpOiBhbnkgfCB1bmRlZmluZWQge1xuICB0cnkge1xuICAgIGNvbnN0IGxpYlJvb3QgPSBwYXRoLmRpcm5hbWUocmVxdWlyZS5yZXNvbHZlKCdhd3MtY2RrLWxpYi9wYWNrYWdlLmpzb24nKSk7XG4gICAgY29uc3QgbW9kID0gcmVxdWlyZShwYXRoLmpvaW4obGliUm9vdCwgJ2NvcmUvbGliL3ZhbGlkYXRpb24vcHJpdmF0ZS9tb2Rlcm4tZm9ybWF0dGVyLmpzJykpO1xuICAgIHJldHVybiB0eXBlb2YgbW9kPy5mb3JtYXRWYWxpZGF0aW9uUmVwb3J0cyA9PT0gJ2Z1bmN0aW9uJyA/IG1vZCA6IHVuZGVmaW5lZDtcbiAgfSBjYXRjaCB7XG4gICAgcmV0dXJuIHVuZGVmaW5lZDtcbiAgfVxufVxuXG4vLyDjgqjjg7Pjgrjjg7PvvIhXQVNN77yJ44Gu5Yid5pyf5YyW44Gv6YeN44GE44Gf44KB44CB44Oi44K444Ol44O844Or44Os44OZ44Or44Gn44Kt44Oj44OD44K344Ol44GZ44KLXG5sZXQgY2FjaGVkRW5naW5lTW9kdWxlOiBhbnkgfCBmYWxzZSB8IHVuZGVmaW5lZDtcbmZ1bmN0aW9uIGxvYWRFbmdpbmVDYWNoZWQoKTogYW55IHwgdW5kZWZpbmVkIHtcbiAgaWYgKGNhY2hlZEVuZ2luZU1vZHVsZSA9PT0gdW5kZWZpbmVkKSB7XG4gICAgY2FjaGVkRW5naW5lTW9kdWxlID0gbG9hZEVuZ2luZSgpID8/IGZhbHNlO1xuICB9XG4gIHJldHVybiBjYWNoZWRFbmdpbmVNb2R1bGUgPT09IGZhbHNlID8gdW5kZWZpbmVkIDogY2FjaGVkRW5naW5lTW9kdWxlO1xufVxuXG5jb25zdCByZWdvRW5naW5lQ2FjaGUgPSBuZXcgTWFwPHN0cmluZywgYW55PigpO1xuZnVuY3Rpb24gcmVnb0VuZ2luZUNhY2hlZChlbmdpbmVNb2R1bGU6IGFueSwgcnVsZXM6IEJ1bmRsZWRSdWxlRGF0YVtdLCByZWdpb24/OiBzdHJpbmcsIGFjY291bnQ/OiBzdHJpbmcpOiBhbnkge1xuICBjb25zdCBrZXkgPSBgJHtyZWdpb24gPz8gJyd9fCR7YWNjb3VudCA/PyAnJ318JHtydWxlcy5tYXAoKHIpID0+IHIuaWQpLmpvaW4oJywnKX1gO1xuICBpZiAoIXJlZ29FbmdpbmVDYWNoZS5oYXMoa2V5KSkge1xuICAgIGNvbnN0IGN1c3RvbVJ1bGVzID0gW1xuICAgICAgLi4uQlVORExFRF9MSUJTLm1hcCgobCkgPT4gKHsgbmFtZTogbC5uYW1lLCBjb250ZW50OiBsLnJlZ28gfSkpLFxuICAgICAgLi4ucnVsZXMubWFwKChyKSA9PiAoeyBuYW1lOiByLmlkLCBjb250ZW50OiByLnJlZ28gfSkpLFxuICAgIF07XG4gICAgaWYgKHJlZ2lvbiAhPT0gdW5kZWZpbmVkKSB7XG4gICAgICBjdXN0b21SdWxlcy5wdXNoKGRlcGxveUVudmlyb25tZW50TW9kdWxlKHJlZ2lvbiwgYWNjb3VudCkpO1xuICAgIH1cbiAgICByZWdvRW5naW5lQ2FjaGUuc2V0KGtleSwgbmV3IGVuZ2luZU1vZHVsZS5SZWdvRW5naW5lKHsgY3VzdG9tUnVsZXMgfSkpO1xuICB9XG4gIHJldHVybiByZWdvRW5naW5lQ2FjaGUuZ2V0KGtleSk7XG59XG5cbi8qKlxuICogQGF3cy9jbG91ZGZvcm1hdGlvbi12YWxpZGF0ZSDjgpLop6PmsbrjgZnjgovjgIJcbiAqIOmAmuW4uOOBryBhd3MtY2RrLWxpYiDjgYwgYnVuZGxlZERlcGVuZGVuY2llcyDjgajjgZfjgablkIzmorHjgZfjgabjgYTjgovjgrPjg5Tjg7zjgavkuZfjgovjgIJcbiAqIO+8iOODhuOCueODiOOBi+OCieOCguWIqeeUqOOBmeOCi+OBn+OCgSBleHBvcnQg44GX44Gm44GE44KL77yJXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBsb2FkRW5naW5lKCk6IGFueSB8IHVuZGVmaW5lZCB7XG4gIHRyeSB7XG4gICAgcmV0dXJuIHJlcXVpcmUoJ0Bhd3MvY2xvdWRmb3JtYXRpb24tdmFsaWRhdGUnKTtcbiAgfSBjYXRjaCB7XG4gICAgLy8gZmFsbCB0aHJvdWdoXG4gIH1cbiAgdHJ5IHtcbiAgICBjb25zdCBsaWJQa2cgPSByZXF1aXJlLnJlc29sdmUoJ2F3cy1jZGstbGliL3BhY2thZ2UuanNvbicpO1xuICAgIGNvbnN0IGVuZ1BrZyA9IHJlcXVpcmUucmVzb2x2ZSgnQGF3cy9jbG91ZGZvcm1hdGlvbi12YWxpZGF0ZS9wYWNrYWdlLmpzb24nLCB7XG4gICAgICBwYXRoczogW3BhdGguZGlybmFtZShsaWJQa2cpXSxcbiAgICB9KTtcbiAgICByZXR1cm4gcmVxdWlyZShwYXRoLmRpcm5hbWUoZW5nUGtnKSk7XG4gIH0gY2F0Y2gge1xuICAgIHJldHVybiB1bmRlZmluZWQ7XG4gIH1cbn1cbiJdfQ==